CVE-2026-26081
Fixed in a distro release EPSS <1%CVSS 4.8
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
Products: haproxy
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | haproxy | 3.0.11-1+deb13u2 |
| Debian 14 | haproxy | 3.2.11-2 |
| Red Hat hummingbird 1 | haproxy | 0:3.0.25-0.1.1.hum1 |
| SUSE Linux Enterprise High Availability Extension 16.0 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 |
| SUSE Linux Micro 6.2 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 |
| Ubuntu 25.10 | haproxy | 3.0.12-0ubuntu0.25.10.3 |
| openSUSE Leap 16.0 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 |
| openSUSE Tumbleweed | haproxy | 3.3.3+git0.465d8e2fc-1.1 |