CVE-2026-26081
published 2026-07-20CVE-2026-26081: HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
PriorityP425medium4.8CVSS 3.1
AVNACHPRNUINSUCNILAL
EPSS
0.48%
40.8th percentile
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
Affected
91 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | haproxy | < haproxy 3.2.11-2 (forky) | haproxy 3.2.11-2 (forky) |
| haproxy | aloha | >= 16.5.0.0 < 16.5.30 | 16.5.30 |
| haproxy | aloha | >= 17.0.0 < 17.0.18 | 17.0.18 |
| haproxy | aloha | >= 17.5.0 < 17.5.16 | 17.5.16 |
| haproxy | haproxy | — | — |
| haproxy | haproxy | >= 3.0 < 3.0.12 | 3.0.12 |
| haproxy | haproxy | >= 3.0.0 < 3.0.16 | 3.0.16 |
| haproxy | haproxy | >= 3.1 < 3.1.14 | 3.1.14 |
| haproxy | haproxy | >= 3.2 < 3.2.12 | 3.2.12 |
| haproxy | haproxy | >= 3.3 < 3.3.3 | 3.3.3 |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
| haproxy | haproxy_enterprise | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
vendor_redhat4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HAProxy ALOHA/HAProxy up to 3.0.11/3.1.13/3.2.11/3.3.2 NEW_TOKEN buffer overflow
vuldb·2026-08-25·CVSS 4.8
CVE-2026-26081 [MEDIUM] HAProxy ALOHA/HAProxy up to 3.0.11/3.1.13/3.2.11/3.3.2 NEW_TOKEN buffer overflow
A vulnerability identified as very critical has been detected in HAProxy ALOHA and HAProxy up to 3.0.11/3.1.13/3.2.11/3.3.2. This affects an unknown function of the component NEW_TOKEN. This manipulation causes buffer overflow.
This vulnerability is handled as CVE-2026-26081. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format.
ghsa_unreviewed·2026-07-20
CVE-2026-26081 [MEDIUM] CWE-130 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format.
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
Red Hat
haproxy: HAProxy: Data integrity and availability vulnerability in NEW_TOKEN format
vendor_redhat·2026-07-20·CVSS 4.8
CVE-2026-26081 [MEDIUM] CWE-120 haproxy: HAProxy: Data integrity and availability vulnerability in NEW_TOKEN format
haproxy: HAProxy: Data integrity and availability vulnerability in NEW_TOKEN format
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
A flaw was found in HAProxy. This vulnerability, stemming from a missing length check in the NEW_TOKEN format, could allow a remote attacker to cause a low impact on data integrity and availability. This means an attacker might be able to subtly alter data or temporarily disrupt the service.
Package: haproxy (Red Hat Hardened Images) - Affected
Ubuntu
HAProxy vulnerability
vendor_ubuntu·2026-02-12
CVE-2026-26081 HAProxy vulnerability
Title: HAProxy vulnerability
Summary: HAProxy could be made to crash if it received specially crafted network
traffic.
Asim Viladi Oglu Manizada discovered that HAProxy incorrectly handled
certain INITIAL packets. A remote attacker could possibly use this issue
to cause HAProxy to crash, resulting in a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2026-26081: haproxy
vendor_debian·2026
CVE-2026-26081 [LOW] CVE-2026-26081: haproxy
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 3.2.11-2)
sid: resolved (fixed in 3.2.11-2)
trixie: resolved (fixed in 3.0.11-1+deb13u2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-26081 haproxy: HAProxy: Data integrity and availability vulnerability in NEW_TOKEN format
bugzilla·2026-07-20·CVSS 4.8
CVE-2026-26081 [MEDIUM] CVE-2026-26081 haproxy: HAProxy: Data integrity and availability vulnerability in NEW_TOKEN format
CVE-2026-26081 haproxy: HAProxy: Data integrity and availability vulnerability in NEW_TOKEN format
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
Wiz
CVE-2026-26081 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-26081 [HIGH] CVE-2026-26081 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26081 :
HAProxy vulnerability analysis and mitigation
crash via INITIAL packet for the NEW_TOKEN format
Source : NVD
Published February 12, 2026
CNA Score N/A
Affected Technologies
HAProxy
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
haproxy
Sources
NVD
Debian 13, 14 Has Fix Added at: Feb 12, 2026
Ubuntu 25.10 Severity MEDIUM Has Fix Added at: Feb 15, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related HAProxy vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV
Wiz
CVE-2026-26080 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2026-26080 [HIGH] CVE-2026-26080 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-26080 :
HAProxy vulnerability analysis and mitigation
crash in parsing frame type
Source : NVD
Published February 12, 2026
CNA Score N/A
Affected Technologies
HAProxy
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
haproxy
Sources
NVD
Debian 14 Has Fix Added at: Feb 12, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.
## Related HAProxy vulnerabilities:
CVE ID
Severity
Score
Technologies
Component name
CISA KEV exploit
Has fix
Published date
CVE-2025-11230
HIGH
7.5
HAProxy
haproxy-2.4
No
2026-07-20
Published