Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
HAProxy can be forced to stop responding
published 14 days ago
Summary
Web servers running HAProxy may be tricked by a crafted web request into using all of their processing power, causing the service to become unresponsive. This happens even if the attacker is not logged in and the connection is closed. Upgrade HAProxy to the latest version (3.4.6 or newer, or at least 2.9.11-9) to prevent this issue.
What to do
- Update haproxy to version 2.9.11-9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | haproxy |
< 2.9.11-9 Fix: upgrade to 2.9.11-9
|
| Azure Linux:3 | azure | haproxy | <= 2.9.11-8 |
Original advisory text
CVE-2026-110354 affecting package haproxy for versions less than 2.9.11-9
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
References
Timeline
Published22 Oct 2026
Updated2 Nov 2026
First seen25 Oct 2026
Sources
AZL-111017 · OSV
Track software like this
Free during beta