p PatchFirst

CVE-2026-26080

CVE-2026-26080

This page contains facts from public vulnerability sources. Check the original advisory before updating.

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

CVSS 3.7 · Low · EPSS 0.5% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • haproxy

    Versions
    • ≥ 3.2, < 3.2.12: Affected (custom)
    • ≥ 3.3, < 3.3.3: Affected (custom)

    Update to 3.2.12; Update to 3.3.3

  • haproxy Debian:14

    Versions
    • 3.0.11-1
    • 3.1.0-1
    • 3.1.0-2
    • 3.1.1-1
    • 3.1.2-1
    • 3.1.3-1
    • 3.1.5-1
    • 3.1.6-1
    • 3.1.7-1
    • 3.2.0-1
    • 3.2.1-1
    • 3.2.10-1
    • 3.2.11-1
    • 3.2.3-1
    • 3.2.3-2
    • 3.2.4-1
    • 3.2.5-1
    • 3.2.5-2
    • 3.2.6-1
    • 3.2.7-1
    • 3.2.8-1
    • 3.2.9-1
    Affected ranges
    • ECOSYSTEM: < 3.2.11-2

    Update to 3.2.11-2

Original sources

Check your server →