CVE-2026-26081: Medium severity HAProxy Technologies HAProxy Community Edition vulnerability
Published Jul 20, 2026
·Updated
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected.
Affected Software
92 affected componentsFixes available
HAProxy Technologies HAProxy Community Edition>=3.0<3.3.3
HAProxy Technologies HAProxy Enterprise
HAProxy Technologies ALOHΑ
Microsoft azl3 haproxy 2.9.11-8<2.9.11-8
2.9.11-8
HAProxy HAProxy>=3.0.0<3.0.16
HAProxy HAProxy>=3.1<3.1.14
HAProxy HAProxy>=3.2<3.2.12
HAProxy HAProxy>=3.3<3.3.3
HAProxy ALOHA>=16.5.0.0<16.5.30
HAProxy ALOHA>=17.0.0<17.0.18
HAProxy ALOHA>=17.5.0<17.5.16
HAProxy HAProxy Enterprise=3.0r1-1.0.0-337.363
HAProxy HAProxy Enterprise=3.0r1-1.0.0-337.390
HAProxy HAProxy Enterprise=3.0r1-1.0.0-337.394
HAProxy HAProxy Enterprise=3.0r1-1.0.0-339.395
HAProxy HAProxy Enterprise=3.0r1-1.0.0-339.405
HAProxy HAProxy Enterprise=3.0r1-1.0.0-339.415
HAProxy HAProxy Enterprise=3.0r1-1.0.0-339.455
HAProxy HAProxy Enterprise=3.0r1-1.0.0-339.466
HAProxy HAProxy Enterprise=3.0r1-1.0.0-339.471
HAProxy HAProxy Enterprise=3.0r1-1.0.0-341.475
HAProxy HAProxy Enterprise=3.0r1-1.0.0-342.482
HAProxy HAProxy Enterprise=3.0r1-1.0.0-344.495
HAProxy HAProxy Enterprise=3.0r1-1.0.0-344.503
HAProxy HAProxy Enterprise=3.0r1-1.0.0-344.561
HAProxy HAProxy Enterprise=3.0r1-1.0.0-344.564
HAProxy HAProxy Enterprise=3.0r1-1.0.0-344.591
HAProxy HAProxy Enterprise=3.0r1-1.0.0-344.608
HAProxy HAProxy Enterprise=3.0r1-1.0.0-344.641
HAProxy HAProxy Enterprise=3.0r1-1.0.0-344.655
HAProxy HAProxy Enterprise=3.0r1-1.0.0-344.672
HAProxy HAProxy Enterprise=3.0r1-1.0.0-345.673
HAProxy HAProxy Enterprise=3.0r1-1.0.0-346.792
HAProxy HAProxy Enterprise=3.0r1-1.0.0-346.795
HAProxy HAProxy Enterprise=3.0r1-1.0.0-346.800
HAProxy HAProxy Enterprise=3.0r1-1.0.0-346.803
HAProxy HAProxy Enterprise=3.0r1-1.0.0-346.810
HAProxy HAProxy Enterprise=3.0r1-1.0.0-346.834
HAProxy HAProxy Enterprise=3.0r1-1.0.0-347.835
HAProxy HAProxy Enterprise=3.0r1-1.0.0-348.870
HAProxy HAProxy Enterprise=3.0r1-1.0.0-348.875
HAProxy HAProxy Enterprise=3.0r1-1.0.0-349.880
HAProxy HAProxy Enterprise=3.0r1-1.0.0-349.883
HAProxy HAProxy Enterprise=3.0r1-1.0.0-349.885
HAProxy HAProxy Enterprise=3.0r1-1.0.0-349.903
HAProxy HAProxy Enterprise=3.0r1-1.0.0-349.916
HAProxy HAProxy Enterprise=3.0r1-1.0.0-350.918
HAProxy HAProxy Enterprise=3.0r1-1.0.0-350.928
HAProxy HAProxy Enterprise=3.1r1-1.0.0-345.233
HAProxy HAProxy Enterprise=3.1r1-1.0.0-346.274
HAProxy HAProxy Enterprise=3.1r1-1.0.0-346.287
HAProxy HAProxy Enterprise=3.1r1-1.0.0-347.299
HAProxy HAProxy Enterprise=3.1r1-1.0.0-347.338
HAProxy HAProxy Enterprise=3.1r1-1.0.0-347.362
HAProxy HAProxy Enterprise=3.1r1-1.0.0-347.405
HAProxy HAProxy Enterprise=3.1r1-1.0.0-347.419
HAProxy HAProxy Enterprise=3.1r1-1.0.0-347.431
HAProxy HAProxy Enterprise=3.1r1-1.0.0-347.449
HAProxy HAProxy Enterprise=3.1r1-1.0.0-348.519
HAProxy HAProxy Enterprise=3.1r1-1.0.0-349.585
HAProxy HAProxy Enterprise=3.1r1-1.0.0-350.593
HAProxy HAProxy Enterprise=3.1r1-1.0.0-350.602
HAProxy HAProxy Enterprise=3.1r1-1.0.0-350.625
HAProxy HAProxy Enterprise=3.1r1-1.0.0-350.633
HAProxy HAProxy Enterprise=3.1r1-1.0.0-351.652
HAProxy HAProxy Enterprise=3.1r1-1.0.0-352.687
HAProxy HAProxy Enterprise=3.1r1-1.0.0-353.690
HAProxy HAProxy Enterprise=3.1r1-1.0.0-353.692
HAProxy HAProxy Enterprise=3.1r1-1.0.0-353.715
HAProxy HAProxy Enterprise=3.1r1-1.0.0-353.730
HAProxy HAProxy Enterprise=3.1r1-1.0.0-354.732
HAProxy HAProxy Enterprise=3.1r1-1.0.0-354.743
HAProxy HAProxy Enterprise=3.2r1-1.0.0-353.334
HAProxy HAProxy Enterprise=3.2r1-1.0.0-353.336
HAProxy HAProxy Enterprise=3.2r1-1.0.0-353.347
HAProxy HAProxy Enterprise=3.2r1-1.0.0-353.355
HAProxy HAProxy Enterprise=3.2r1-1.0.0-353.376
HAProxy HAProxy Enterprise=3.2r1-1.0.0-353.385
HAProxy HAProxy Enterprise=3.2r1-1.0.0-353.398
HAProxy HAProxy Enterprise=3.2r1-1.0.0-354.402
HAProxy HAProxy Enterprise=3.2r1-1.0.0-354.439
HAProxy HAProxy Enterprise=3.2r1-1.0.0-358.439
HAProxy HAProxy Enterprise=3.2r1-1.0.0-359.440
HAProxy HAProxy Enterprise=3.2r1-1.0.0-360.460
HAProxy HAProxy Enterprise=3.2r1-1.0.0-362.473
HAProxy HAProxy Enterprise=3.2r1-1.0.0-363.476
HAProxy HAProxy Enterprise=3.2r1-1.0.0-363.478
HAProxy HAProxy Enterprise=3.2r1-1.0.0-363.498
HAProxy HAProxy Enterprise=3.2r1-1.0.0-363.511
HAProxy HAProxy Enterprise=3.2r1-1.0.0-365.529
HAProxy HAProxy Enterprise=3.2r1-1.0.0-365.531
HAProxy HAProxy Enterprise=3.2r1-1.0.0-365.545
Remediation
Event History
Jul 20, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jul 23, 2026
Data Sourced
via Microsoft·08:05 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:05 AM
Affected Software
Updated
via Microsoft·08:05 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2026-26081?
The severity of CVE-2026-26081 is classified as medium with a score of 4.8.
2
How do I fix CVE-2026-26081?
To fix CVE-2026-26081, upgrade HAProxy to version 3.3.3 or later.
3
What software is affected by CVE-2026-26081?
CVE-2026-26081 affects HAProxy Community Edition versions 3.0 through 3.3 and also impacts HAProxy Enterprise and ALOHA.
4
What type of vulnerability is CVE-2026-26081?
CVE-2026-26081 is a lack of length check vulnerability associated with the NEW_TOKEN format.
5
What are the potential impacts of CVE-2026-26081?
CVE-2026-26081 can lead to issues with data integrity as it allows for a potential length overflow.