CVE-2026-26080: HAProxy Varint Mishandling Leading to Loop or Crash
Summary
CVE-2026-26080: HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. Affects haproxy across 2 version ranges.
>= 3.2.0, < 3.2.12
>= 3.3.0, < 3.3.3
Fixed in 3.2.12 or 3.3.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HAProxy is a widely used open-source software that provides high availability, load balancing, and proxying for TCP and HTTP applications. It is known for its performance and reliability, making it a popular choice for managing web traffic. The vulnerability in question affects HAProxy Community Edition versions 3.2.x through 3.3.x prior to 3.3.3, as well as HAProxy Enterprise and ALOHA, due to improper handling of varint data types.
Vulnerability Detail
The vulnerability arises from a mishandling of varint data types in HAProxy, which can lead to an infinite loop or crash of the application. This issue can be exploited by an attacker to disrupt service availability, potentially leading to denial of service (DoS) conditions. The technical aspect of this vulnerability is critical, as it affects the core functionality of HAProxy, making it essential for users to address it promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.2.0, < 3.2.123.2.12 -
>= 3.3.0, < 3.3.33.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can limit the input data to prevent the mishandling of varint types, although this is not a substitute for applying the patch. Additionally, monitoring the application for unusual behavior may help mitigate the impact until the update is applied.
Conclusion
In summary, CVE-2026-26080 is a significant vulnerability affecting multiple versions of HAProxy due to mishandling of varint data types. Users are strongly advised to update to the latest patched versions to mitigate the risk of service disruption.
See every vulnerability recorded for haproxy →
FAQ
CVE-2026-26080 is a vulnerability in HAProxy that can cause the application to enter a loop or crash due to improper handling of varint data types.
HAProxy Community Edition versions 3.2.x through 3.3.x before 3.3.3, as well as HAProxy Enterprise and ALOHA, are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial of service (DoS) conditions, disrupting the availability of the HAProxy service.
You can update HAProxy by using your package manager or downloading the latest version from the official HAProxy website. For example, use 'sudo apt-get install haproxy=3.3.3' to install the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for haproxy.
