HAProxy allows denial of service via HTTP/2 PING frames (CVE-2026-110353)
Remote attackers can trigger CPU exhaustion and denial of service in HAProxy servers through malformed HTTP/2 PING frames.
40
Vulnerability1 · 1 read
CVE-2026-110354
CPU exhaustion DoS in HAProxy 3 before 3.4.6
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
HAProxy 3 before 3.4.6 mishandles HTTP/1.1 chunked requests: the H1 parser drains the request but then reprocesses the same bytes without progress. A remote unauthenticated attacker needs no user interaction. The worker thread stays at 100% CPU after timeouts and after the client disconnects, and repeated requests can occupy every worker until the process is restarted. Only availability is affected.
What to do: Upgrade HAProxy 3 to 3.4.6. Restart the process to clear threads already stuck at 100% CPU.
| Product | Affected | Fixed in |
|---|---|---|
| HAProxy | 3 before 3.4.6 | 3.4.6 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
- Weakness
- CWE-835
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H