← All advisories

Medium severity4.8NVD Advisory· Published Jul 20, 2026· Updated Jul 21, 2026

CVE-2026-26081

CVE-2026-26081

Description

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Affected products

8

Haproxy/HAProxy Community Editionllm-create
Range: 3.0 - 3.3 before 3.3.3
ALOHA/ALOHAllm-create
Haproxy/Haproxy Enterprisellm-fuzzy
osv-coords5 versions
pkg:rpm/opensuse/haproxy&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/haproxy&distro=openSUSE%20Tumbleweed pkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2016.0 pkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Micro%206.2
< 3.2.12+git0.6011f448e-160000.1.1+ 4 more
- (no CPE)range: < 3.2.12+git0.6011f448e-160000.1.1
- (no CPE)range: < 3.3.3+git0.465d8e2fc-1.1
- (no CPE)range: < 3.2.12+git0.6011f448e-160000.1.1
- (no CPE)range: < 3.2.12+git0.6011f448e-160000.1.1
- (no CPE)range: < 3.2.12+git0.6011f448e-160000.1.1

Patches

Vulnerability mechanics

References

2

git.haproxy.orgnvd
www.haproxy.orgnvd

News mentions

0

No linked articles in our index yet.