What’s Vulnerable › Vulnerabilities

CVE-2026-26080

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-20 · updated 2026-08-25
• Weakness: CWE-252

Description

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

Affected products

• HAProxy Aloha: from 17.0.0 before 17.0.18; from 17.5.0 before 17.5.16 — fixed in 17.0.18, 17.5.16
• HAProxy: from 3.2 before 3.2.12; from 3.3 before 3.3.3 — fixed in 3.2.12, 3.3.3
• Haproxy Enterprise: 3.2r1-1.0.0-353.334, 3.2r1-1.0.0-353.336, 3.2r1-1.0.0-353.347, 3.2r1-1.0.0-353.355, 3.2r1-1.0.0-353.376, 3.2r1-1.0.0-353.385 (+14)

How to fix

Upgrade to a fixed version: HAProxy Aloha 17.0.18, 17.5.16; HAProxy 3.2.12, 3.3.3. Check the vendor advisory for mitigations.

References

• https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=5bb098ce8a656ec5711b4de3e4c87f12b216e7a1
• https://www.haproxy.org

Get alerted when CVE-2026-26080 or the next vulnerability affects your stack