HAProxy vulnerabilities

CVEs per yearBy the year they were published

1. 20252
2. 20269

Newest CVEs

• CVE-2026-110353

  HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING…

  HAProxy · HAProxy

  High7.5
• CVE-2026-110354

  HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked…

  HAProxy · HAProxy

  High7.5
• CVE-2026-109575

  In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic…

  HAProxy · Data Plane API EE

  Critical9.8
• CVE-2026-90678

  An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with…

  HAProxy · HAProxy

  High7.5
• CVE-2026-26081

  HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

  HAProxy · HAProxy

  Medium4.8
• CVE-2026-26080

  HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also…

  HAProxy · HAProxy

  Low3.7
• CVE-2026-55204

  HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

  haproxy · haproxy

  High8.7
• CVE-2026-55203

  HAProxy - Integer Overflow in FCGI Demux Record Length Field

  haproxy · haproxy

  Critical9.0
• CVE-2026-33555

  An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length…

  HAProxy · HAProxy

  Medium4.0
• CVE-2025-59303

  HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update…

  HAProxy · HAProxy Kubernetes Ingress Controller

  Medium6.4