CVE-2026-26080
Fixed in a distro release EPSS <1%CVSS 3.7
HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.
Products: haproxy
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 14 | haproxy | 3.2.11-2 |
| Red Hat hummingbird 1 | haproxy | 0:3.0.25-0.1.1.hum1 |
| SUSE Linux Enterprise High Availability Extension 16.0 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 |
| SUSE Linux Micro 6.2 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 |
| openSUSE Leap 16.0 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 |