VYPR
← All advisories
Medium severity4.8NVD Advisory· Published Jul 20, 2026· Updated Aug 25, 2026

CVE-2026-26081

CVE-2026-26081

Description

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

92
  • Haproxy/Aloha
    cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:*
    Range: >=16.5.0.0,<16.5.30
  • Haproxy/Haproxy
    cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*
    Range: >=3.0.0,<3.0.16
  • Haproxy/Haproxy Enterprise82 versions
    cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.363:*:*:*:*:*:*+ 81 more
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.363:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.390:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.394:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.395:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.405:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.415:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.455:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.466:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.471:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-341.475:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-342.482:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.495:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.503:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.561:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.564:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.591:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.608:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.641:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.655:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.672:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-345.673:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.792:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.795:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.800:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.803:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.810:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.834:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-347.835:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.870:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.875:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.880:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.883:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.885:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.903:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.916:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.918:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.928:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-345.233:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.274:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.287:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.299:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.338:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.362:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.405:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.419:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.431:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.449:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-348.519:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-349.585:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.593:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.602:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.625:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.633:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-351.652:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-352.687:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.690:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.692:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.715:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.730:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.732:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.743:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.334:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.336:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.347:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.355:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.376:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.385:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.398:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.402:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.439:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-358.439:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-359.440:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-360.460:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-362.473:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.476:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.478:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.498:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.511:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.529:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.531:*:*:*:*:*:*
    • cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.545:*:*:*:*:*:*
    • (no CPE)
  • Haproxy/HAProxy Community Editionllm-create
    Range: 3.0 - 3.3 before 3.3.3
  • ALOHA/ALOHAllm-create
  • osv-coords6 versions
    pkg:bitnami/haproxypkg:rpm/opensuse/haproxy&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/haproxy&distro=openSUSE%20Tumbleweedpkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2016.0pkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0pkg:rpm/suse/haproxy&distro=SUSE%20Linux%20Micro%206.2
    >= 3.0.0, < 3.0.16+ 5 more
    • (no CPE)range: >= 3.0.0, < 3.0.16
    • (no CPE)range: < 3.2.12+git0.6011f448e-160000.1.1
    • (no CPE)range: < 3.3.3+git0.465d8e2fc-1.1
    • (no CPE)range: < 3.2.12+git0.6011f448e-160000.1.1
    • (no CPE)range: < 3.2.12+git0.6011f448e-160000.1.1
    • (no CPE)range: < 3.2.12+git0.6011f448e-160000.1.1

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.