HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread…
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 12:18:27 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Security Response Center Microsoft | Affected
| Fixed in
|
Description
HAProxy versions before 3.4.6, including version 3.0, contain a vulnerability that allows a remote unauthenticated attacker to cause a denial of service by triggering a persistent worker-thread issue. The vulnerability is identified as CWE-835. No CVSS score or detailed technical exploitation information is provided. No known exploits are reported in the wild. There is no explicit vendor advisory or patch link available in the provided data.
Impact
An attacker can remotely cause a denial of service, potentially disrupting HAProxy service availability. There is no indication of privilege escalation, data disclosure, or code execution. No known active exploitation has been reported.
Weaknesses
- CWE-835Loop with Unreachable Exit Condition ('Infinite Loop') (opens in a new tab)
Base weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.