CyberSecBulletin
CVE-2026-110354NVD status: Awaiting Analysis

HAProxy: Loop with Unreachable Exit Condition

Published Updated By the CyberSecBulletin desk

CVE-2026-110354 is a high-severity loop with unreachable exit condition vulnerability in HAProxy, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 3.0.30, 3.2.26, 3.3.17 as the first without the flaw, so updating HAProxy to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.81% chance of exploitation within 30 days, higher than 57% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update HAProxy to 3.0.30 or 3.2.26 or 3.3.17 or 3.4.6, whichever matches your release line, or a later version.
  2. Update HAProxy Enterprise Edition to 3.0r1-362.1441 or 3.2r1-378.1259 or 3.3r1-377.1005, whichever matches your release line, or a later version.
  3. Update HAProxy Kubernetes Ingress Controller to 3.2.17 or a later version.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
HAProxyHAProxy3.0.0 up to, but not including, 3.0.30; 3.2.0 up to, but not including, 3.2.26; 3.3.0 up to, but not including, 3.3.17; 3.4.0 up to, but not including, 3.4.6; 3.5-dev up to, but not including, 3.5-dev93.0.30, 3.2.26, 3.3.17, 3.4.6, 3.5-dev9
HAProxyHAProxy Enterprise Edition3.0r1 up to, but not including, 3.0r1-362.1441; 3.2r1 up to, but not including, 3.2r1-378.1259; 3.3r1 up to, but not including, 3.3r1-377.10053.0r1-362.1441, 3.2r1-378.1259, 3.3r1-377.1005
HAProxy TechnologiesHAProxy Kubernetes Ingress Controller3.2.0 up to, but not including, 3.2.173.2.17
HAProxy TechnologiesKubernetes Ingress Controller Enterprise3.2.0 up to, but not including, 3.2.17-ee1; 3.0 up to, but not including, 3.0.16-ee17; 1.11 up to, but not including, 1.11.14-ee113.2.17-ee1, 3.0.16-ee17, 1.11.14-ee11

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA (mitre.org).

Official description

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Loop with Unreachable Exit Condition

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

More Loop with Unreachable Exit Condition vulnerabilities (CWE-835)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).

References

Other vulnerabilities in HAProxy

All HAProxy vulnerabilities

Recent Loop with Unreachable Exit Condition vulnerabilities

Spotted an error? Tell us.