CVE-2026-110354
Description
A flaw was found in haproxy. A remote, unauthenticated attacker can trigger a denial of service (DoS) by sending a specially crafted HTTP/1.1 chunked request. When processing the request, the parser repeatedly re-evaluates the same data without making forward progress, trapping the worker thread in a continuous loop that consumes 100% CPU. Multiple malicious requests can exhaust all worker threads, rendering the proxy completely unresponsive until restarted.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can cause severe service degradation and complete denial of service across all processing threads without requiring special privileges. HAProxy is widely utilized across Red Hat ecosystems, including Red Hat Enterprise Linux and OpenShift ingress layers, where it routinely faces untrusted network traffic with standard HTTP/1.1 support enabled. Since the CPU exhaustion persists indefinitely within the worker threads even after connections drop, repeated requests will paralyze the entire load-balancing proxy until the service is restarted.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
