CVE-2026-26080

Analyzed Analyzed - Analysis Complete

Heap Overflow in HAProxy Community Edition

Publication date: 2026-07-20

Last updated on: 2026-08-25

Assigner: MITRE

Description

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-08-25

Generated

2026-08-30

AI Q&A

2026-07-20

EPSS Evaluated

2026-08-29

NVD

CVE-2026-26080

EUVD

EUVD-2026-45988

Affected Vendors & Products

Vendor	Product	Version / Range
haproxy	haproxy	From 3.2 (inc) to 3.2.12 (exc)
haproxy	haproxy	From 3.3 (inc) to 3.3.3 (exc)
haproxy	aloha	From 17.0.0 (inc) to 17.0.18 (exc)
haproxy	aloha	From 17.5.0 (inc) to 17.5.16 (exc)
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1
haproxy	haproxy_enterprise	3.2r1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

Executive Summary

This vulnerability involves HAProxy Community Edition versions 3.2.x through 3.3.x before 3.3.3 mishandling variable-length integers (varint) in QUIC frame parsing. Malformed varint values are incorrectly interpreted as PADDING frames, causing the parser to mishandle subsequent packet data. This can lead to infinite loops or crashes in the system.

Detection Guidance

Check HAProxy version with 'haproxy -v' to see if it is 3.2.x through 3.3.x before 3.3.3. Monitor logs for crashes or infinite loops during QUIC traffic processing. Enable debug mode with 'haproxy -d' to observe parsing behavior.

Impact Analysis

The vulnerability can cause HAProxy to enter an infinite loop or crash, disrupting network traffic handling. This may lead to service outages, degraded performance, or denial of service for applications relying on HAProxy for load balancing or proxy services.

Compliance Impact

This vulnerability causes crashes or infinite loops in HAProxy due to improper varint handling in QUIC frame parsing. While not directly tied to data exposure, such instability could disrupt logging, monitoring, or security controls required for compliance with GDPR or HIPAA. However, the provided context does not specify direct impacts on these standards.

Mitigation Strategies

Upgrade HAProxy to version 3.3.3 or later. If using HAProxy Enterprise or ALOHA, apply the vendor's patched version. Ensure the fix for the quic_dec_int() function is backported to your release.

Hi! I’m here to help you understand CVE-2026-26080. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70