Description (CNA)
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| HAProxy / HAProxy | affected 3.0.0 before 3.0.30; affected 3.2.0 before 3.2.26; affected 3.3.0 before 3.3.17; affected 3.4.0 before 3.4.6; affected 3.5-dev before 3.5-dev9 |
| HAProxy / HAProxy Enterprise Edition | affected 3.0r1 before 3.0r1-362.1441; affected 3.2r1 before 3.2r1-378.1259; affected 3.3r1 before 3.3r1-377.1005 |
| HAProxy Technologies / HAProxy Kubernetes Ingress Controller | affected 3.2.0 before 3.2.17 |
| HAProxy Technologies / Kubernetes Ingress Controller Enterprise | affected 3.2.0 before 3.2.17-ee1; affected 3.0 before 3.0.16-ee17; affected 1.11 before 1.11.14-ee11 |
CWE
CWE-835
References
ADP enrichment
No English description supplied.
No references supplied.