What’s Vulnerable › Vulnerabilities

CVE-2026-26081

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-20 · updated 2026-08-25
• Weakness: CWE-130

Description

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Affected products

• HAProxy Aloha: from 16.5.0.0 before 16.5.30; from 17.0.0 before 17.0.18; from 17.5.0 before 17.5.16 — fixed in 16.5.30, 17.0.18, 17.5.16
• HAProxy: from 3.0.0 before 3.0.16; from 3.1 before 3.1.14; from 3.2 before 3.2.12; from 3.3 before 3.3.3 — fixed in 3.0.16, 3.1.14, 3.2.12, 3.3.3
• Haproxy Enterprise: 3.0r1-1.0.0-337.363, 3.0r1-1.0.0-337.390, 3.0r1-1.0.0-337.394, 3.0r1-1.0.0-339.395, 3.0r1-1.0.0-339.405, 3.0r1-1.0.0-339.415 (+75)

How to fix

Upgrade to a fixed version: HAProxy Aloha 16.5.30, 17.0.18, 17.5.16; HAProxy 3.0.16, 3.1.14, 3.2.12, 3.3.3. Check the vendor advisory for mitigations.

References

• https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=4765277f4f915baac2d57db63538ff0a59966deb
• https://www.haproxy.org

Get alerted when CVE-2026-26081 or the next vulnerability affects your stack