Bug 2558749 (CVE-2026-110354)

Summary:	CVE-2026-110354 haproxy: haproxy: Denial of Service via specially crafted HTTP/1.1 chunked request
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, amctagga, aoconnor, aos-team-art-private, asdas, bniver, dpaolell, flucifre, gmeno, groman, jdelft, jupierce, lgarciaa, mbenjamin, mbiarnes, mhackett, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, sostapov, suppawar, vereddy, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in haproxy. A remote, unauthenticated attacker can trigger a denial of service (DoS) by sending a specially crafted HTTP/1.1 chunked request. When processing the request, the parser repeatedly re-evaluates the same data without making forward progress, trapping the worker thread in a continuous loop that consumes 100% CPU. Multiple malicious requests can exhaust all worker threads, rendering the proxy completely unresponsive until restarted.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-22 02:51:29 UTC

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.