Skip to content
Fencer Vulns
low 3.7

CVE-2026-26080 json

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled.

published 2026-07-20 3 mo ago modified 2026-09-08 2 mo ago also BIT-haproxy-2026-26080 , EUVD-2026-45988

cvss
3.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

Patch / fix

  • bitnami haproxy 3.2.12, 3.3.3
  • HAProxy HAProxy 3.2.12, 3.3.3
  • haproxy Debian 14 3.2.11-2

debian advisories DEBIAN-CVE-2026-26080

  • haproxy hummingbird 1 3.0.25-0.1.1.hum1

red hat advisories RHSA-2026:40938

  • haproxy SLE High Availability Extension 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.2.12+git0.6011f448e-160000.1.1

suse advisories SUSE-SU-2026:20616-1SUSE-SU-2026:20557-1SUSE-SU-2026:20620-1

  • haproxy openSUSE Leap 16.0 3.2.12+git0.6011f448e-160000.1.1

opensuse advisories openSUSE-SU-2026:20290-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-26080 updated cvss 5.9

haproxy: HAProxy: Denial of Service due to mishandled varint

  • Red Hat Hardened Images haproxy 3.0.25-0.1.1.hum1
    fixed: vendor fix “No mitigation is required. No Red Hat product ships an affected version of HAProxy.” RHSA-2026:40938
  • Red Hat Ceph Storage 5 haproxy, haproxy22, rhceph/rhceph-haproxy-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-haproxy-rhel9 Red Hat Ceph Storage 7 rhceph/rhceph-haproxy-rhel9 Red Hat Ceph Storage 8 rhceph/rhceph-haproxy-rhel9 Red Hat Ceph Storage 9 rhceph-ci/haproxy, rhceph/rhceph-haproxy-rhel9, rhceph/rhceph-haproxy-rhel10 Red Hat Enterprise Linux 7 haproxy
    +5 more products
    Red Hat Enterprise Linux 8 haproxy Red Hat Enterprise Linux 9 haproxy Red Hat Enterprise Linux 10 haproxy Red Hat OpenShift Container Platform 4 haproxy, haproxy18, haproxy20, haproxy22, haproxy26, haproxy28 Red Hat OpenShift Container Platform 5 haproxy
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
OSV 3.1 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
bitnami haproxy
>=3.2.0, <3.2.12
>=3.3.0, <3.3.3
3.2.12
3.3.3

Affected products

  • HAProxy HAProxy

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.