Vulnerabilities

TI-2026-21085 CVE-2026-26081 · GHSA-c8q6-qrfh-727c

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the…

LOW 23

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00476 Published 2026-07-20 Partial fix · 3.0.12, 3.1.14 +2 CWE-130

TI-2026-21084 CVE-2026-26080 · GHSA-fhrv-3q89-79q6

LOW 18

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00546 Published 2026-07-20 Fixed in 3.2.12, 3.3.3 CWE-252

TI-2025-10285 CVE-2025-11230 · GHSA-fc36-5gc3-jmhx

MEDIUM 40

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0074 Published 2025-11-19 Partial fix · 2.4.30, 2.6.23 +4 CWE-407