# CVE-2026-110354: HAProxy denial of service in HTTP/1.1 chunked request parsing

Source: https://junglewise.ai/threats/cve-2026-110354-haproxy-3-before-3-4-6-allows-a-remote-unauthenticated-attacker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-110354 · Severity: high · CVSS 7.5 · Published 2026-10-22

HAProxy is a load balancer that distributes network traffic across servers. An attacker can send specially crafted HTTP requests to exhaust worker threads, causing the service to become unresponsive and require a restart. Remote attackers can exploit this without authentication.

Technologies: [HAProxy](https://junglewise.ai/threats/technologies/haproxy). Vendors: [HAProxy](https://junglewise.ai/threats/vendors/haproxy).

## Quick answers

**Is CVE-2026-110354 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110354 being exploited in the wild.

**How severe is CVE-2026-110354?** High severity, with a CVSS score of 7.5, published 22 October 2026.

**Which products and versions are affected?** HAProxy 3.x before 3.4.6.

**Is there a fix for CVE-2026-110354?** Yes: fixed in HAProxy 3.4.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110354 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-110354?** Check whether you run HAProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in HAProxy 3.4.6

## Technical details

A flaw in HAProxy 3.x's HTTP/1.1 chunked request parser causes the parser to repeatedly re-process the same bytes without progress, spinning the worker thread at 100% CPU. The condition persists after client disconnection and timeout expiration; repeated requests exhaust all worker threads, forcing process restart. Attack requires no authentication and can be delivered over the network.

## Affected products

- HAProxy HAProxy 3.x before 3.4.6

## Timeline

- 2026-10-22: disclosed

## References

- [https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81](https://git.haproxy.org/?p=haproxy.git;a=commit;h=077906da140a35873bf451d7e9f67646c9f37c81)

## Related threats

- [HAProxy denial of service via truncated HTTP/2 PING frame](https://junglewise.ai/threats/cve-2026-110353-haproxy-3-2-before-3-4-6-allows-a-remote-unauthenticated)
- [HAProxy HTTP request smuggling in HTTP/3 multiplexer](https://junglewise.ai/threats/cve-2026-90678-haproxy-http-request-smuggling-in-http-3-multiplexer)
- [HAProxy NULL pointer dereference in hpack_dht_insert](https://junglewise.ai/threats/cve-2026-55204-haproxy-null-pointer-dereference-in-hpack-dht-insert)
- [HAProxy integer overflow in FCGI demultiplexer](https://junglewise.ai/threats/cve-2026-55203-haproxy-integer-overflow-in-fcgi-demultiplexer)
- [HAProxy request smuggling via HTTP/3 standalone FIN desynchronization](https://junglewise.ai/threats/cve-2026-33555-haproxy-request-smuggling-via-http-3-standalone-fin)