CVE-2026-26081

CVE-2026-26081 affects HAProxy Community Edition 3.0–3.3 prior to 3.3.3 and HAProxy Enterprise/ALOHA. The issue is a missing length check in the NEW_TOKEN format, enabling a potential denial-of-service condition. The CVSS base score is 4.8 (Medium) with network attack vector, high complexity, no ...

CVE-2026-26080

HAProxy vulnerability CVE-2026-26080 affects HAProxy Community Edition 3.2.x–3.3.x prior to 3.3.3; HAProxy Enterprise and ALOHA are affected. Root cause: mishandling of varint can cause a loop or crash, leading to DoS. Remediation: upgrade to 3.3.3 or newer (openSUSE/SUSE advisories also referenc...

CVE-2025-11230

CVE-2025-11230 affects HAProxy due to inefficient algorithm complexity in the mjson library, enabling remote denial-of-service via specially crafted JSON requests. Connected documents specify vulnerable haproxy versions: < 2.4.24-2 and