CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Scoring

Severity

MEDIUM

CVSS base score

4.8

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS probability

0.48%

CWE

CWE-130

Published

2026-07-20

Last modified

2026-07-20

Affected products

• HAProxy HAProxy
• HAProxy HAProxy
• HAProxy HAProxy
• HAProxy HAProxy

Weakness type

• CWE-130

Related vulnerabilities

• CVE-2026-15418 — CP210x Memory Leakage
• CVE-2026-71337 — Windows Storage Management Provider Elevation of Privilege Vulnerability
• CVE-2026-5706 — Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements
• CVE-2026-71402 — wicked: out-of-bounds read in the DHCPv4 option parser due to payload length taken from the IP total length
• CVE-2026-81575 — Missing Sanity Checks for Buffer Lengths
• CVE-2026-58097 — ppp(8): missing length validation in mp_SetEnddisc()
• CVE-2026-58096 — ppp(8): missing length validation in LcpDecodeConfig()
• CVE-2026-14587 — Unathenticated connection can hold Bolt channel open

Markdown version · Browse all CVEs