Description
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HAProxy | HAProxy | 3.0.0 – < 3.0.30, 3.2.0 – < 3.2.26, 3.3.0 – < 3.3.17, 3.4.0 – < 3.4.6, 3.5-dev – < 3.5-dev9 | 3.0.30 |
| HAProxy | HAProxy Enterprise Edition | 3.0r1 – < 3.0r1-362.1441, 3.2r1 – < 3.2r1-378.1259, 3.3r1 – < 3.3r1-377.1005 | 3.0r1-362.1441 |
| HAProxy Technologies | HAProxy Kubernetes Ingress Controller | 3.2.0 – < 3.2.17 | 3.2.17 |
| HAProxy Technologies | Kubernetes Ingress Controller Enterprise | 3.2.0 – < 3.2.17-ee1, 3.0 – < 3.0.16-ee17, 1.11 – < 1.11.14-ee11 | 3.2.17-ee1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 3.2.26-1 | — |
| Debian 13 | haproxy | 3.0.11-1+deb13u4 | — |
| Debian 12 | haproxy | 2.6.12-1+deb12u4 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | haproxy | 3.4.2-1ubuntu4.1 | USN-8972-1 |
| Ubuntu 26.04 LTS | haproxy | 3.2.25-0ubuntu0.26.04.2 | USN-8972-1 |
| Ubuntu 24.04 LTS | haproxy | 2.8.30-0ubuntu0.24.04.2 | USN-8972-1 |
| Ubuntu 22.04 LTS | haproxy | 2.4.30-0ubuntu0.22.04.3 | USN-8972-1 |
| Ubuntu 20.04 LTS | haproxy | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | haproxy | No fix yet | — |
| Ubuntu Pro 16.04 LTS | haproxy | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | haproxy | 3.0.30-0.1.hum1 | RHSA-2026:83844 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 3.4.7+git57.0faeaeda6-2.1 | openSUSE-SU-2026:12431-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | haproxy | 3.0.30-1.amzn2023.0.1 | ALAS2023-2026-3388 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | haproxy | 2.9.11-9 | — |
Advisories 5
- RHSA-2026:83844 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- ALAS2023-2026-3388 Important: haproxy security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- openSUSE-SU-2026:12431-1 haproxy-3.4.7+git57.0faeaeda6-2.1 on GA media SUSE / openSUSE Security Updates · Nov 6, 2026
- WID-SEC-2026-4114 HAProxy: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 5, 2026
- USN-8972-1 haproxy vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026