Haproxy Kubernetes Ingress Controller
Monthly
HAProxy 3.x releases before 3.4.6 can be driven into persistent denial of service by remote unauthenticated attackers sending a single crafted HTTP/1.1 chunked request: the H1 multiplexer's chunk parser re-processes the same bytes without advancing, pinning one worker thread at 100% CPU even after timeouts fire and the client disconnects. Repeating the request exhausts the worker pool until the process is manually restarted, so confidentiality and integrity are unaffected but availability is fully lost. Attack surface is standard HTTP/1.1 frontend traffic (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-835); no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the upstream fix commit is published in the HAProxy git repository.
HAProxy 3.x releases before 3.4.6 can be driven into persistent denial of service by remote unauthenticated attackers sending a single crafted HTTP/1.1 chunked request: the H1 multiplexer's chunk parser re-processes the same bytes without advancing, pinning one worker thread at 100% CPU even after timeouts fire and the client disconnects. Repeating the request exhausts the worker pool until the process is manually restarted, so confidentiality and integrity are unaffected but availability is fully lost. Attack surface is standard HTTP/1.1 frontend traffic (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-835); no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the upstream fix commit is published in the HAProxy git repository.