p PatchFirst

CVE-2026-26081

CVE-2026-26081

This page contains facts from public vulnerability sources. Check the original advisory before updating.

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

CVSS 4.8 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • haproxy

    Versions
    • ≥ 3.0, < 3.0.12: Affected (custom)
    • ≥ 3.1, < 3.1.14: Affected (custom)
    • ≥ 3.2, < 3.2.12: Affected (custom)
    • ≥ 3.3, < 3.3.3: Affected (custom)

    Update to 3.0.12; Update to 3.1.14; Update to 3.2.12; Update to 3.3.3

  • haproxy Debian:13

    Versions
    • 3.0.11-1
    • 3.0.11-1+deb13u1
    Affected ranges
    • ECOSYSTEM: < 3.0.11-1+deb13u2

    Update to 3.0.11-1+deb13u2

  • haproxy Debian:14

    Versions
    • 3.0.11-1
    • 3.1.0-1
    • 3.1.0-2
    • 3.1.1-1
    • 3.1.2-1
    • 3.1.3-1
    • 3.1.5-1
    • 3.1.6-1
    • 3.1.7-1
    • 3.2.0-1
    • 3.2.1-1
    • 3.2.10-1
    • 3.2.11-1
    • 3.2.3-1
    • 3.2.3-2
    • 3.2.4-1
    • 3.2.5-1
    • 3.2.5-2
    • 3.2.6-1
    • 3.2.7-1
    • 3.2.8-1
    • 3.2.9-1
    Affected ranges
    • ECOSYSTEM: < 3.2.11-2

    Update to 3.2.11-2

  • haproxy Ubuntu:25.10

    Versions
    • 3.0.8-1ubuntu1
    • 3.0.8-1ubuntu1.1
    • 3.0.10-1ubuntu1
    • 3.0.10-1ubuntu2
    • 3.0.10-1ubuntu3
    • 3.0.12-0ubuntu0.25.10.1
    Affected ranges
    • ECOSYSTEM: < 3.0.12-0ubuntu0.25.10.3

    Update to 3.0.12-0ubuntu0.25.10.3

Original sources

Check your server →