medium CVSS 4.8 EPSS 0.48%

CVE-2026-26081·HAProxy vulnerability

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Severity
medium
Software
HAProxy
Fixed in
3.3.3
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.48% — higher than 41% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 3.3

Until: 3.3.3

Fixed in: 3.3.3

How to fix this CVE

Upgrade HAProxy to version 3.3.3 or later to address a token format validation weakness that could allow integrity or availability degradation. Organizations running HAProxy 3.0 through 3.3.2 should prioritize this update as part of routine security maintenance. The fix implements proper length validation for the NEW_TOKEN format to prevent malformed input from bypassing security checks.

sudo dnf check-update haproxy && sudo dnf upgrade haproxy

Defensia detects this vulnerability

How to check if you are affected

  1. Step 1: Check your HAProxy version with 'haproxy -v' and verify if it falls within 3.0 to 3.3.2 range
  2. Step 2: Search HAProxy configuration files for NEW_TOKEN directives: grep -r 'NEW_TOKEN' /etc/haproxy/
  3. Step 3: Review HAProxy error logs for token validation failures: grep -i 'token' /var/log/haproxy.log | grep -i 'error\|invalid\|malformed'
  4. Step 4: After updating, confirm the new version: haproxy -v and verify it shows 3.3.3 or higher

FAQ

What is CVE-2026-26081?

This vulnerability is a missing input validation check in HAProxy's NEW_TOKEN format handler that could permit attackers to craft oversized or malformed tokens, potentially leading to service disruption or data integrity issues.

Is CVE-2026-26081 being actively exploited?

No, this vulnerability is not listed in the CISA KEV catalog and no public exploits are currently available, though organizations should still update proactively.

What versions of HAProxy are affected by CVE-2026-26081?

HAProxy Community Edition versions 3.0 through 3.3.2, and corresponding versions of HAProxy Enterprise and ALOHA products are affected.

How do I check if my server is vulnerable to CVE-2026-26081?

Run 'haproxy -v' and check if the version is between 3.0 and 3.3.2 (inclusive). If so, your installation is vulnerable and requires updating to 3.3.3 or later.

Does Defensia detect CVE-2026-26081?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If HAProxy is installed on a monitored server, CVE-2026-26081 will appear in your dashboard with remediation steps.

Related HAProxy CVEs

CVE-2026-55203CVSS 7.5HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.
CVE-2026-55204CVSS 7.5HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.
CVE-2026-110353CVSS 7.5HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage.
CVE-2026-110354CVSS 7.5HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-26081. Free for 1 server.

Get started free