CVE-2026-110354High· 7.5▾ TwilightHAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the str…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.8%
0.8% → 0.8%
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
HAProxy >= 3.0.0 < 3.0.30HAProxy >= 3.2.0 < 3.2.26HAProxy >= 3.3.0 < 3.3.17HAProxy >= 3.4.0 < 3.4.6HAProxy >= 3.5-dev < 3.5-dev9enterprise_edition >= 3.0r1 < 3.0r1-362.1441enterprise_edition >= 3.2r1 < 3.2r1-378.1259enterprise_edition >= 3.3r1 < 3.3r1-377.1005haproxy_kubernetes_ingress_controller >= 3.2.0 < 3.2.17kubernetes_ingress_controller_enterprise >= 3.2.0 < 3.2.17-ee1kubernetes_ingress_controller_enterprise >= 3.0 < 3.0.16-ee17kubernetes_ingress_controller_enterprise >= 1.11 < 1.11.14-ee11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110353High· 7.5HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame
CVE-2026-33555Medium· 4.0An issue was discovered in HAProxy before 3.3.6
CVE-2026-55203High· 7.5HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers
CVE-2026-55204High· 7.5HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhaust…
CVE-2026-109575Critical· 9.8In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types
CVE-2022-49317Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: f2fs: avoid infinite loop to flush node pages xfstests/generic/475 can give EIO all the time which give an infinite loop to flush node page like below