CVE-2026-110354

A flaw was found in haproxy. A remote, unauthenticated attacker can trigger a denial of service (DoS) by sending a specially crafted HTTP/1.1 chunked request. When processing the request, the parser repeatedly re-evaluates the same data without making forward progress, trapping the worker thread in a continuous loop that consumes 100% CPU. Multiple malicious requests can exhaust all worker threads, rendering the proxy completely unresponsive until restarted.

This vulnerability is rated as Important severity because an unauthenticated remote attacker can cause severe service degradation and complete denial of service across all processing threads without requiring special privileges. HAProxy is widely utilized across Red Hat ecosystems, including Red Hat Enterprise Linux and OpenShift ingress layers, where it routinely faces untrusted network traffic with standard HTTP/1.1 support enabled. Since the CPU exhaustion persists indefinitely within the worker threads even after connections drop, repeated requests will paralyze the entire load-balancing proxy until the service is restarted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.