Every CVE Search/ Get API key

CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN...

4.8 MediumFix available

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.48%Up 0.1 points since Jul 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Record
CVE-2026-26081
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-130
Updated
2026-11-02
EUVDEUVD-2026-45989 4.8

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Record
EUVD-2026-45989
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-c8q6-qrfh-727c 4.8

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN...

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Record
GHSA-c8q6-qrfh-727c
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-130
Updated
2026-11-02
NVD 4.8

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Record
CVE-2026-26081
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-130
Updated
2026-11-02
OSV 4.8

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Record
CVE-2026-26081
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-130
Updated
2026-11-02
OSVDEBIAN-CVE-2026-26081 4.8

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Record
DEBIAN-CVE-2026-26081
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
Show 12 moreShow less
OSVOESA-2026-3229 4.8

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.(CVE-2026-26081)

Record
OESA-2026-3229
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVOESA-2026-3230 4.8

haproxy security update

HAProxy is a free, very fast and reliable solution offering high availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for very high traffic web sites and powers quite a number of the world's most visited ones.

Security Fix(es):

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.(CVE-2026-26081)

Record
OESA-2026-3230
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVRHSA-2026:40938 5.9

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:40938
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-26081 4.8

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Record
UBUNTU-CVE-2026-26081
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVAZL-93000 No score

CVE-2026-26081 affecting package haproxy for versions less than 2.9.11-8

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Record
AZL-93000
Updated
2026-11-05
OSVBIT-haproxy-2026-26081 No score

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Record
BIT-haproxy-2026-26081
Updated
2026-11-02
OSVopenSUSE-SU-2026:10187-1 No score

haproxy-3.3.3+git0.465d8e2fc-1.1 on GA media

These are all security issues fixed in the haproxy-3.3.3+git0.465d8e2fc-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10187-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20290-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

  • Update to version 3.2.12+git0.6011f448e
  • CVE-2026-26081: Fixed a DOS vulnerability in QUIC. (bsc#1257976)
  • CVE-2026-26080: Fixed a DOS vulnerability in QUIC. (bsc#1257976)
Record
openSUSE-SU-2026:20290-1
Updated
2026-11-02
OSVSUSE-SU-2026:20557-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

  • Update to version 3.2.12+git0.6011f448e
  • CVE-2026-26081: Fixed a DOS vulnerability in QUIC. (bsc#1257976)
  • CVE-2026-26080: Fixed a DOS vulnerability in QUIC. (bsc#1257976)
Record
SUSE-SU-2026:20557-1
Updated
2026-11-02
OSVSUSE-SU-2026:20616-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

  • Update to version 3.2.12+git0.6011f448e
  • CVE-2026-26081: Fixed a DOS vulnerability in QUIC. (bsc#1257976)
  • CVE-2026-26080: Fixed a DOS vulnerability in QUIC. (bsc#1257976)
Record
SUSE-SU-2026:20616-1
Updated
2026-11-02
OSVSUSE-SU-2026:20620-1 No score

Security update for haproxy

This update for haproxy fixes the following issues:

  • Update to version 3.2.12+git0.6011f448e
  • CVE-2026-26081: Fixed a DOS vulnerability in QUIC. (bsc#1257976)
  • CVE-2026-26080: Fixed a DOS vulnerability in QUIC. (bsc#1257976)
Record
SUSE-SU-2026:20620-1
Updated
2026-11-02
OSVUSN-8036-1 No score

haproxy vulnerability

Asim Viladi Oglu Manizada discovered that HAProxy incorrectly handled certain INITIAL packets. A remote attacker could possibly use this issue to cause HAProxy to crash, resulting in a denial of service.

Record
USN-8036-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
haproxy
Azure Linux:3
 before 2.9.11-8
2.9.11-8
haproxy
Bitnami
 3.0.0 up to 3.0.16, 3.1.0 up to 3.1.14, 3.2.0 up to 3.2.12, 3.3.0 up to 3.3.3
3.0.163.1.143.2.123.3.3
haproxy
Debian:13
 before 3.0.11-1+deb13u2, plus listed versions
3.0.11-13.0.11-1+deb13u1
3.0.11-1+deb13u2
haproxy
Debian:14
 before 3.2.11-2, plus listed versions
3.0.11-13.1.0-13.1.0-23.1.1-13.1.2-1
Show 17 moreShow less
3.1.3-13.1.5-13.1.6-13.1.7-13.2.0-13.2.1-13.2.10-13.2.11-13.2.3-13.2.3-23.2.4-13.2.5-13.2.5-23.2.6-13.2.7-13.2.8-13.2.9-1
3.2.11-2
haproxy
openEuler:24.03-LTS-SP3
 before 3.0.11-4.oe2403sp3
3.0.11-4.oe2403sp3
haproxy
openEuler:24.03-LTS-SP4
 before 3.0.11-4.oe2403sp4
3.0.11-4.oe2403sp4
haproxy
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:3.0.25-0.1.1.hum1
0:3.0.25-0.1.1.hum1
haproxy
SUSE:Linux Micro 6.2
From an advisory covering 2 CVEs
 before 3.2.12+git0.6011f448e-160000.1.1
3.2.12+git0.6011f448e-160000.1.1
haproxy
SUSE:Linux Enterprise High Availability Extension 16.0
From an advisory covering 2 CVEs
 before 3.2.12+git0.6011f448e-160000.1.1
3.2.12+git0.6011f448e-160000.1.1
haproxy
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 3.2.12+git0.6011f448e-160000.1.1
3.2.12+git0.6011f448e-160000.1.1
haproxy
Ubuntu:25.10
 before 3.0.12-0ubuntu0.25.10.3, plus listed versions
3.0.8-1ubuntu13.0.8-1ubuntu1.13.0.10-1ubuntu13.0.10-1ubuntu23.0.10-1ubuntu33.0.12-0ubuntu0.25.10.1
3.0.12-0ubuntu0.25.10.3
haproxy
openSUSE:Tumbleweed
 before 3.3.3+git0.465d8e2fc-1.1
3.3.3+git0.465d8e2fc-1.1
haproxy
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 3.2.12+git0.6011f448e-160000.1.1
3.2.12+git0.6011f448e-160000.1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-26081 is a medium vulnerability (CVSS 4.8) in Haproxy Aloha, published February 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in haproxy 2.9.11-8.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open