HAProxy EUVD-2026-108000

No special conditions - remote unauthenticated exploitation against default configurations of HAProxy 3 (before 3.4.6) that process HTTP/1.1 traffic through the H1 multiplexer; the only prerequisite is that the frontend accepts and parses HTTP/1.1 chunked requests, which is standard for HTTP load-balancing deployments. The specific trigger is a crafted HTTP/1.1 chunked request that causes the parser to re-process the same bytes without progress. Limiting factors: the instance must be running an affected 3.x version below 3.4.6 and be reachable by the attacker; impact is confined to availability (no data compromise), and recovery requires a process restart. Deployments that terminate only HTTP/2 or that are not exposed to untrusted clients are at reduced practical risk.

This is a genuine availability-impacting vulnerability worth prioritizing, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is fully consistent with the description: a remote, unauthenticated attacker over the network, with low complexity and no user interaction, triggers an infinite-loop condition (CWE-835) by sending a single malformed HTTP/1.1 chunked request. The impact is purely to availability (C:N/I:N/A:H) - no data exposure or integrity loss - but it is severe because a single affected worker thread pegs at 100% CPU indefinitely, surviving both timeout expiry and client disconnect, and repeated requests can exhaust all worker threads until the process is restarted. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set, so there is no evidence of active exploitation or weaponization at this time. The gap between a high CVSS availability score and the absence of exploitation signals suggests the real-world risk today is 'high-severity, not-yet-exploited': the bug is trivially reachable against any default HTTP-processing HAProxy 3 instance, so the barrier to exploitation is low and POC/mass-exploitation could emerge quickly once the patch commit is analyzed. Treat as a prioritized patch for internet-facing load balancers. No signals conflict; the primary missing data is EPSS/KEV/POC status, whose absence is not evidence of safety for a low-complexity, unauthenticated DoS.

A remote unauthenticated attacker sends a specially crafted HTTP/1.1 chunked request to an internet-facing HAProxy 3 frontend. The H1 multiplexer drains and closes the stream but the parser re-processes the same bytes without progressing, pinning a worker thread at 100% CPU that does not recover after timeouts or client disconnect; the attacker repeats the request across connections to consume every worker thread and render the proxy unresponsive until restarted. No public exploit code was identified in the provided intelligence.