BIT-haproxy-2026-26081: Medium severity HAProxy Technologies HAProxy Community Edition vulnerability

Q: Which deployments are affected?

HAProxy Community Edition versions 3.0 through 3.3 before 3.3.3 are affected. HAProxy Enterprise and ALOHA are also affected, but the supplied data does not identify their fixed versions.

Q: What must an attacker do to exploit this issue?

The issue concerns a missing length check for the NEW_TOKEN format. The supplied CVSS vector indicates network reachability, no required privileges or user interaction, and high attack complexity.

Q: What is the potential impact?

Successful exploitation can affect integrity and availability at a low level. The supplied CVSS vector indicates no confidentiality impact.

Published Jul 20, 2026

Updated

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected.

Affected Software

3 affected components

HAProxy Technologies HAProxy Community Edition>=3.0<3.3.3

HAProxy Technologies HAProxy Enterprise

HAProxy Technologies HAProxy ALOHA

Event History

Jul 20, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

HAProxy Community Edition versions 3.0 through 3.3 before 3.3.3 are affected. HAProxy Enterprise and ALOHA are also affected, but the supplied data does not identify their fixed versions.

What must an attacker do to exploit this issue?

The issue concerns a missing length check for the NEW_TOKEN format. The supplied CVSS vector indicates network reachability, no required privileges or user interaction, and high attack complexity.

What is the potential impact?

Successful exploitation can affect integrity and availability at a low level. The supplied CVSS vector indicates no confidentiality impact.

BIT-haproxy-2026-26081: Medium severity HAProxy Technologies HAProxy Community Edition vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker do to exploit this issue?

What is the potential impact?