CVE-2026-110354

Name	CVE-2026-110354
Description	HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4842-1, DSA-6570-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
haproxy (PTS)	bookworm	2.6.12-1+deb12u3	vulnerable
	bookworm (security)	2.6.12-1+deb12u4	fixed
	trixie	3.0.11-1+deb13u3	vulnerable
	trixie (security)	3.0.11-1+deb13u4	fixed
	forky, sid	3.2.26-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
haproxy	source	bookworm	2.6.12-1+deb12u4	DLA-4842-1
haproxy	source	trixie	3.0.11-1+deb13u4	DSA-6570-1
haproxy	source	(unstable)	3.2.26-1

Notes

Fixed by: https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=a5f625bd1bc433d0d1d44d28f7b0789f79ae60c0 (v3.2.26)
Fixed by: https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=fd0864b83920851eeaaa0dd934bfebc82ba6ca27 (v3.0.30)
Fixed by: https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=68609955873ff845220b7a7cf22147d3617a0b42 (v2.6.35)