medium4.8
CVE-2026-26081
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format.
Impact
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Haproxy | Haproxy | from 3.0.0 before 3.0.16 from 3.1 before 3.1.14 from 3.2 before 3.2.12 from 3.3 before 3.3.3 |
| Haproxy | Aloha | from 16.5.0.0 before 16.5.30 from 17.0.0 before 17.0.18 from 17.5.0 before 17.5.16 |
| Haproxy | Haproxy Enterprise | Versions 3.0r1, 3.1r1, 3.2r1 |