Read the docs
TI-2026-21085 Aliases CVE-2026-26081GHSA-c8q6-qrfh-727c

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the…

Priority LOW 23CWE-130Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 1 fixed, 11 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00476 41st percentileScored 2026-11-07
Fix Partial HAProxy (HAProxy): 3.0.12, 3.1.14, 3.2.12 +1Red Hat: 1 advisoryRed Hat: 1 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HAProxyHAProxy3.0 to before 3.0.12; 3.1 to before 3.1.14; 3.2 to before 3.2.12; 3.3 to before 3.3.33.0.12, 3.1.14, 3.2.12, 3.3.3Patch availableCNA
  • HAProxy VendorHAProxy Affected 3.0 to before 3.0.12; 3.1 to before 3.1.14; 3.2 to before 3.2.12; 3.3 to before 3.3.3 Fixed in 3.0.12, 3.1.14, 3.2.12, 3.3.3 Patch available CNA

CPE configurations NVD · 83

CPEVersionsRoleVendor
cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*3.0.0 to before 3.0.16; 3.1 to before 3.1.14; 3.2 to before 3.2.12; 3.3 to before 3.3.3VulnerableHAProxy
cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:*16.5.0.0 to before 16.5.30; 17.0.0 to before 17.0.18; 17.5.0 to before 17.5.16VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.363:*:*:*:*:*:*3.0r1 1.0.0-337.363VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.390:*:*:*:*:*:*3.0r1 1.0.0-337.390VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.394:*:*:*:*:*:*3.0r1 1.0.0-337.394VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.395:*:*:*:*:*:*3.0r1 1.0.0-339.395VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.405:*:*:*:*:*:*3.0r1 1.0.0-339.405VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.415:*:*:*:*:*:*3.0r1 1.0.0-339.415VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.455:*:*:*:*:*:*3.0r1 1.0.0-339.455VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.466:*:*:*:*:*:*3.0r1 1.0.0-339.466VulnerableHAProxy
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.0.16; 3.1 to before 3.1.14; 3.2 to before 3.2.12; 3.3 to before 3.3.3 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:* Versions 16.5.0.0 to before 16.5.30; 17.0.0 to before 17.0.18; 17.5.0 to before 17.5.16 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.363:*:*:*:*:*:* Versions 3.0r1 1.0.0-337.363 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.390:*:*:*:*:*:* Versions 3.0r1 1.0.0-337.390 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.394:*:*:*:*:*:* Versions 3.0r1 1.0.0-337.394 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.395:*:*:*:*:*:* Versions 3.0r1 1.0.0-339.395 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.405:*:*:*:*:*:* Versions 3.0r1 1.0.0-339.405 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.415:*:*:*:*:*:* Versions 3.0r1 1.0.0-339.415 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.455:*:*:*:*:*:* Versions 3.0r1 1.0.0-339.455 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.466:*:*:*:*:*:* Versions 3.0r1 1.0.0-339.466 Vulnerable ·HAProxy
Show 73 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.471:*:*:*:*:*:*3.0r1 1.0.0-339.471VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-341.475:*:*:*:*:*:*3.0r1 1.0.0-341.475VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-342.482:*:*:*:*:*:*3.0r1 1.0.0-342.482VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.495:*:*:*:*:*:*3.0r1 1.0.0-344.495VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.503:*:*:*:*:*:*3.0r1 1.0.0-344.503VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.561:*:*:*:*:*:*3.0r1 1.0.0-344.561VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.564:*:*:*:*:*:*3.0r1 1.0.0-344.564VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.591:*:*:*:*:*:*3.0r1 1.0.0-344.591VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.608:*:*:*:*:*:*3.0r1 1.0.0-344.608VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.641:*:*:*:*:*:*3.0r1 1.0.0-344.641VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.655:*:*:*:*:*:*3.0r1 1.0.0-344.655VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.672:*:*:*:*:*:*3.0r1 1.0.0-344.672VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-345.673:*:*:*:*:*:*3.0r1 1.0.0-345.673VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.792:*:*:*:*:*:*3.0r1 1.0.0-346.792VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.795:*:*:*:*:*:*3.0r1 1.0.0-346.795VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.800:*:*:*:*:*:*3.0r1 1.0.0-346.800VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.803:*:*:*:*:*:*3.0r1 1.0.0-346.803VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.810:*:*:*:*:*:*3.0r1 1.0.0-346.810VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.834:*:*:*:*:*:*3.0r1 1.0.0-346.834VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-347.835:*:*:*:*:*:*3.0r1 1.0.0-347.835VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.870:*:*:*:*:*:*3.0r1 1.0.0-348.870VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.875:*:*:*:*:*:*3.0r1 1.0.0-348.875VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.880:*:*:*:*:*:*3.0r1 1.0.0-349.880VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.883:*:*:*:*:*:*3.0r1 1.0.0-349.883VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.885:*:*:*:*:*:*3.0r1 1.0.0-349.885VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.903:*:*:*:*:*:*3.0r1 1.0.0-349.903VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.916:*:*:*:*:*:*3.0r1 1.0.0-349.916VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.918:*:*:*:*:*:*3.0r1 1.0.0-350.918VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.928:*:*:*:*:*:*3.0r1 1.0.0-350.928VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-345.233:*:*:*:*:*:*3.1r1 1.0.0-345.233VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.274:*:*:*:*:*:*3.1r1 1.0.0-346.274VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.287:*:*:*:*:*:*3.1r1 1.0.0-346.287VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.299:*:*:*:*:*:*3.1r1 1.0.0-347.299VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.338:*:*:*:*:*:*3.1r1 1.0.0-347.338VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.362:*:*:*:*:*:*3.1r1 1.0.0-347.362VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.405:*:*:*:*:*:*3.1r1 1.0.0-347.405VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.419:*:*:*:*:*:*3.1r1 1.0.0-347.419VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.431:*:*:*:*:*:*3.1r1 1.0.0-347.431VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.449:*:*:*:*:*:*3.1r1 1.0.0-347.449VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-348.519:*:*:*:*:*:*3.1r1 1.0.0-348.519VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-349.585:*:*:*:*:*:*3.1r1 1.0.0-349.585VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.593:*:*:*:*:*:*3.1r1 1.0.0-350.593VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.602:*:*:*:*:*:*3.1r1 1.0.0-350.602VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.625:*:*:*:*:*:*3.1r1 1.0.0-350.625VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.633:*:*:*:*:*:*3.1r1 1.0.0-350.633VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-351.652:*:*:*:*:*:*3.1r1 1.0.0-351.652VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-352.687:*:*:*:*:*:*3.1r1 1.0.0-352.687VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.690:*:*:*:*:*:*3.1r1 1.0.0-353.690VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.692:*:*:*:*:*:*3.1r1 1.0.0-353.692VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.715:*:*:*:*:*:*3.1r1 1.0.0-353.715VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.730:*:*:*:*:*:*3.1r1 1.0.0-353.730VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.732:*:*:*:*:*:*3.1r1 1.0.0-354.732VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.743:*:*:*:*:*:*3.1r1 1.0.0-354.743VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.334:*:*:*:*:*:*3.2r1 1.0.0-353.334VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.336:*:*:*:*:*:*3.2r1 1.0.0-353.336VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.347:*:*:*:*:*:*3.2r1 1.0.0-353.347VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.355:*:*:*:*:*:*3.2r1 1.0.0-353.355VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.376:*:*:*:*:*:*3.2r1 1.0.0-353.376VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.385:*:*:*:*:*:*3.2r1 1.0.0-353.385VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.398:*:*:*:*:*:*3.2r1 1.0.0-353.398VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.402:*:*:*:*:*:*3.2r1 1.0.0-354.402VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.439:*:*:*:*:*:*3.2r1 1.0.0-354.439VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-358.439:*:*:*:*:*:*3.2r1 1.0.0-358.439VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-359.440:*:*:*:*:*:*3.2r1 1.0.0-359.440VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-360.460:*:*:*:*:*:*3.2r1 1.0.0-360.460VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-362.473:*:*:*:*:*:*3.2r1 1.0.0-362.473VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.476:*:*:*:*:*:*3.2r1 1.0.0-363.476VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.478:*:*:*:*:*:*3.2r1 1.0.0-363.478VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.498:*:*:*:*:*:*3.2r1 1.0.0-363.498VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.511:*:*:*:*:*:*3.2r1 1.0.0-363.511VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.529:*:*:*:*:*:*3.2r1 1.0.0-365.529VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.531:*:*:*:*:*:*3.2r1 1.0.0-365.531VulnerableHAProxy
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.545:*:*:*:*:*:*3.2r1 1.0.0-365.545VulnerableHAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.471:*:*:*:*:*:* Versions 3.0r1 1.0.0-339.471 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-341.475:*:*:*:*:*:* Versions 3.0r1 1.0.0-341.475 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-342.482:*:*:*:*:*:* Versions 3.0r1 1.0.0-342.482 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.495:*:*:*:*:*:* Versions 3.0r1 1.0.0-344.495 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.503:*:*:*:*:*:* Versions 3.0r1 1.0.0-344.503 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.561:*:*:*:*:*:* Versions 3.0r1 1.0.0-344.561 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.564:*:*:*:*:*:* Versions 3.0r1 1.0.0-344.564 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.591:*:*:*:*:*:* Versions 3.0r1 1.0.0-344.591 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.608:*:*:*:*:*:* Versions 3.0r1 1.0.0-344.608 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.641:*:*:*:*:*:* Versions 3.0r1 1.0.0-344.641 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.655:*:*:*:*:*:* Versions 3.0r1 1.0.0-344.655 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.672:*:*:*:*:*:* Versions 3.0r1 1.0.0-344.672 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-345.673:*:*:*:*:*:* Versions 3.0r1 1.0.0-345.673 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.792:*:*:*:*:*:* Versions 3.0r1 1.0.0-346.792 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.795:*:*:*:*:*:* Versions 3.0r1 1.0.0-346.795 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.800:*:*:*:*:*:* Versions 3.0r1 1.0.0-346.800 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.803:*:*:*:*:*:* Versions 3.0r1 1.0.0-346.803 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.810:*:*:*:*:*:* Versions 3.0r1 1.0.0-346.810 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.834:*:*:*:*:*:* Versions 3.0r1 1.0.0-346.834 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-347.835:*:*:*:*:*:* Versions 3.0r1 1.0.0-347.835 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.870:*:*:*:*:*:* Versions 3.0r1 1.0.0-348.870 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.875:*:*:*:*:*:* Versions 3.0r1 1.0.0-348.875 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.880:*:*:*:*:*:* Versions 3.0r1 1.0.0-349.880 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.883:*:*:*:*:*:* Versions 3.0r1 1.0.0-349.883 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.885:*:*:*:*:*:* Versions 3.0r1 1.0.0-349.885 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.903:*:*:*:*:*:* Versions 3.0r1 1.0.0-349.903 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.916:*:*:*:*:*:* Versions 3.0r1 1.0.0-349.916 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.918:*:*:*:*:*:* Versions 3.0r1 1.0.0-350.918 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.928:*:*:*:*:*:* Versions 3.0r1 1.0.0-350.928 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-345.233:*:*:*:*:*:* Versions 3.1r1 1.0.0-345.233 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.274:*:*:*:*:*:* Versions 3.1r1 1.0.0-346.274 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.287:*:*:*:*:*:* Versions 3.1r1 1.0.0-346.287 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.299:*:*:*:*:*:* Versions 3.1r1 1.0.0-347.299 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.338:*:*:*:*:*:* Versions 3.1r1 1.0.0-347.338 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.362:*:*:*:*:*:* Versions 3.1r1 1.0.0-347.362 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.405:*:*:*:*:*:* Versions 3.1r1 1.0.0-347.405 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.419:*:*:*:*:*:* Versions 3.1r1 1.0.0-347.419 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.431:*:*:*:*:*:* Versions 3.1r1 1.0.0-347.431 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.449:*:*:*:*:*:* Versions 3.1r1 1.0.0-347.449 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-348.519:*:*:*:*:*:* Versions 3.1r1 1.0.0-348.519 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-349.585:*:*:*:*:*:* Versions 3.1r1 1.0.0-349.585 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.593:*:*:*:*:*:* Versions 3.1r1 1.0.0-350.593 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.602:*:*:*:*:*:* Versions 3.1r1 1.0.0-350.602 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.625:*:*:*:*:*:* Versions 3.1r1 1.0.0-350.625 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.633:*:*:*:*:*:* Versions 3.1r1 1.0.0-350.633 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-351.652:*:*:*:*:*:* Versions 3.1r1 1.0.0-351.652 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-352.687:*:*:*:*:*:* Versions 3.1r1 1.0.0-352.687 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.690:*:*:*:*:*:* Versions 3.1r1 1.0.0-353.690 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.692:*:*:*:*:*:* Versions 3.1r1 1.0.0-353.692 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.715:*:*:*:*:*:* Versions 3.1r1 1.0.0-353.715 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.730:*:*:*:*:*:* Versions 3.1r1 1.0.0-353.730 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.732:*:*:*:*:*:* Versions 3.1r1 1.0.0-354.732 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.743:*:*:*:*:*:* Versions 3.1r1 1.0.0-354.743 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.334:*:*:*:*:*:* Versions 3.2r1 1.0.0-353.334 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.336:*:*:*:*:*:* Versions 3.2r1 1.0.0-353.336 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.347:*:*:*:*:*:* Versions 3.2r1 1.0.0-353.347 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.355:*:*:*:*:*:* Versions 3.2r1 1.0.0-353.355 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.376:*:*:*:*:*:* Versions 3.2r1 1.0.0-353.376 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.385:*:*:*:*:*:* Versions 3.2r1 1.0.0-353.385 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.398:*:*:*:*:*:* Versions 3.2r1 1.0.0-353.398 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.402:*:*:*:*:*:* Versions 3.2r1 1.0.0-354.402 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.439:*:*:*:*:*:* Versions 3.2r1 1.0.0-354.439 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-358.439:*:*:*:*:*:* Versions 3.2r1 1.0.0-358.439 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-359.440:*:*:*:*:*:* Versions 3.2r1 1.0.0-359.440 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-360.460:*:*:*:*:*:* Versions 3.2r1 1.0.0-360.460 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-362.473:*:*:*:*:*:* Versions 3.2r1 1.0.0-362.473 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.476:*:*:*:*:*:* Versions 3.2r1 1.0.0-363.476 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.478:*:*:*:*:*:* Versions 3.2r1 1.0.0-363.478 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.498:*:*:*:*:*:* Versions 3.2r1 1.0.0-363.498 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.511:*:*:*:*:*:* Versions 3.2r1 1.0.0-363.511 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.529:*:*:*:*:*:* Versions 3.2r1 1.0.0-365.529 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.531:*:*:*:*:*:* Versions 3.2r1 1.0.0-365.531 Vulnerable ·HAProxy
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.545:*:*:*:*:*:* Versions 3.2r1 1.0.0-365.545 Vulnerable ·HAProxy

Remediation

  • Fix · CNA HAProxy (HAProxy) Fixed in 3.0.12, 3.1.14, 3.2.12, 3.3.3

Red Hat 1 advisory

  • RHSA-2026:40938 Released 2026-07-16 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images haproxy-3.0.25-0.1.1.hum1@aarch64, haproxy-3.0.25-0.1.1.hum1@src, haproxy-3.0.25-0.1.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 5AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 6AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 7AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 8AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:40938

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-26081
  2. 2026-10-03 Alias added: GHSA-c8q6-qrfh-727c
  3. 2026-11-06 Affected versions changed · Red Hat

References

Patch 1

Other 1

  • TI-2026-21084 HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash… CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences