CVE-2026-110354: HAProxy 3.0.0 to before 3.0.30, 3.2.0 to before 3.2.26, 3.3.0 to before 3.3.17, 3.4.0 to before 3.4.6, 3.5-dev to…

Affected technology

HAProxy · 3.0.0 to before 3.0.30, 3.2.0 to before 3.2.26, 3.3.0 to before 3.3.17, 3.4.0 to before 3.4.6, 3.5-dev to before 3.5-dev9
HAProxy

HAProxy Enterprise Edition · 3.0r1 to before 3.0r1-362.1441, 3.2r1 to before 3.2r1-378.1259, 3.3r1 to before 3.3r1-377.1005
HAProxy

HAProxy Kubernetes Ingress Controller · 3.2.0 to before 3.2.17
HAProxy Technologies

Kubernetes Ingress Controller Enterprise · 3.2.0 to before 3.2.17-ee1, 3.0 to before 3.0.16-ee17, 1.11 to before 1.11.14-ee11
HAProxy Technologies

Description’s affected range: before 3.4.6

Component: mux-h1
Function: h1_parse_msg_data
File: src/h1_htx.c

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A remote unauthenticated attacker can cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Vendor/CNA’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and integrity impact as none; availability impact as high.