CVE-2026-26080
Received Received - Intake

Heap Overflow in HAProxy Community Edition

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: MITRE

Description
HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-26080
EUVD
EUVD-2026-45988

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
haproxy community_edition From 3.2.0 (inc) to 3.3.2 (inc)
haproxy enterprise *
haproxy aloha *
haproxy community_edition From 3.2.0 (inc) to 3.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves HAProxy Community Edition versions 3.2.x through 3.3.x before 3.3.3 mishandling variable-length integers (varint) in QUIC frame parsing. Malformed varint values are incorrectly interpreted as PADDING frames, causing the parser to mishandle subsequent packet data. This can lead to infinite loops or crashes in the system.

Detection Guidance

Check HAProxy version with 'haproxy -v' to see if it is 3.2.x through 3.3.x before 3.3.3. Monitor logs for crashes or infinite loops during QUIC traffic processing. Enable debug mode with 'haproxy -d' to observe parsing behavior.

Impact Analysis

The vulnerability can cause HAProxy to enter an infinite loop or crash, disrupting network traffic handling. This may lead to service outages, degraded performance, or denial of service for applications relying on HAProxy for load balancing or proxy services.

Compliance Impact

This vulnerability causes crashes or infinite loops in HAProxy due to improper varint handling in QUIC frame parsing. While not directly tied to data exposure, such instability could disrupt logging, monitoring, or security controls required for compliance with GDPR or HIPAA. However, the provided context does not specify direct impacts on these standards.

Mitigation Strategies

Upgrade HAProxy to version 3.3.3 or later. If using HAProxy Enterprise or ALOHA, apply the vendor's patched version. Ensure the fix for the quic_dec_int() function is backported to your release.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-26080. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart