Skip to content
Fencer Vulns
medium 4.8

CVE-2026-26081 json

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format.

published 2026-07-20 3 mo ago modified 2026-09-08 2 mo ago also BIT-haproxy-2026-26081 , EUVD-2026-45989

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Patch / fix

  • bitnami haproxy 3.0.16, 3.1.14, 3.2.12, 3.3.3
  • HAProxy HAProxy 3.0.12, 3.1.14, 3.2.12, 3.3.3
  • haproxy Debian 13 3.0.11-1+deb13u2
  • haproxy Debian 14 3.2.11-2

debian advisories DEBIAN-CVE-2026-26081

  • haproxy Ubuntu 25.10 3.0.12-0ubuntu0.25.10.3

ubuntu advisories UBUNTU-CVE-2026-26081

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • haproxy hummingbird 1 3.0.25-0.1.1.hum1

red hat advisories RHSA-2026:40938

  • haproxy SLE High Availability Extension 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 3.2.12+git0.6011f448e-160000.1.1

suse advisories SUSE-SU-2026:20616-1SUSE-SU-2026:20557-1SUSE-SU-2026:20620-1

  • haproxy openSUSE Leap 16.0 3.2.12+git0.6011f448e-160000.1.1
  • haproxy openSUSE Tumbleweed 3.3.3+git0.465d8e2fc-1.1

opensuse advisories openSUSE-SU-2026:20290-1openSUSE-SU-2026:10187-1

  • haproxy Azure Linux 3.0 2.9.11-8

azure linux advisories AZL-93000

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-26081 updated cvss 4.8

haproxy: HAProxy: Data integrity and availability vulnerability in NEW_TOKEN format

  • Red Hat Ceph Storage 5 haproxy, haproxy22, rhceph/rhceph-haproxy-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-haproxy-rhel9 Red Hat Ceph Storage 7 rhceph/rhceph-haproxy-rhel9 Red Hat Ceph Storage 8 rhceph/rhceph-haproxy-rhel9 Red Hat Ceph Storage 9 rhceph-ci/haproxy, rhceph/rhceph-haproxy-rhel9, rhceph/rhceph-haproxy-rhel10 Red Hat Enterprise Linux 7 haproxy
    +5 more products
    Red Hat Enterprise Linux 8 haproxy Red Hat Enterprise Linux 9 haproxy Red Hat Enterprise Linux 10 haproxy Red Hat OpenShift Container Platform 4 haproxy, haproxy18, haproxy20, haproxy22, haproxy26, haproxy28 Red Hat OpenShift Container Platform 5 haproxy
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images haproxy 3.0.25-0.1.1.hum1
    fixed: vendor fix RHSA-2026:40938

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
OSV 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
bitnami haproxy
>=3.0.0, <3.0.16
>=3.1.0, <3.1.14
>=3.2.0, <3.2.12
>=3.3.0, <3.3.3
3.0.16
3.1.14
3.2.12
3.3.3

Affected products

  • HAProxy HAProxy

Classification

Weakness
  • CWE-130 Improper Handling of Length Parameter Inconsistency

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.