Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| HAProxy | HAProxy | unaffected |
|
||||||||||||||||||
| HAProxy | HAProxy Enterprise Edition | unaffected |
|
||||||||||||||||||
| HAProxy Technologies | HAProxy Kubernetes Ingress Controller | unaffected |
|
||||||||||||||||||
| HAProxy Technologies | Kubernetes Ingress Controller Enterprise | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 22 Oct 2026 03:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted. | |
| Weaknesses | CWE-835 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2026-10-22T02:46:38.255Z
Reserved: 2026-10-13T23:22:44.319Z
Link: CVE-2026-110354
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-22T03:16:31.427
Modified: 2026-10-22T03:16:31.427
Link: CVE-2026-110354
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')