Quick answers
- Is CVE-2026-110354 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-110354 being exploited in the wild.
- How severe is CVE-2026-110354?
- High severity, with a CVSS score of 7.5, published 22 October 2026.
- Which products and versions are affected?
- HAProxy 3.x before 3.4.6.
- Is there a fix for CVE-2026-110354?
- Yes: fixed in HAProxy 3.4.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-110354 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-110354?
- Check whether you run HAProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: HAProxy 3.4.6
Technical details
A flaw in HAProxy 3.x's HTTP/1.1 chunked request parser causes the parser to repeatedly re-process the same bytes without progress, spinning the worker thread at 100% CPU. The condition persists after client disconnection and timeout expiration; repeated requests exhaust all worker threads, forcing process restart. Attack requires no authentication and can be delivered over the network.
Affected products
- HAProxy HAProxy 3.x before 3.4.6
Timeline
- 2026-10-22: disclosed