CVE-2026-26081

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:*
cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:*
cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.363:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.390:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.394:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.395:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.405:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.415:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.455:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.466:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.471:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-341.475:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-342.482:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.495:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.503:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.561:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.564:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.591:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.608:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.641:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.655:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.672:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-345.673:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.792:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.795:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.800:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.803:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.810:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.834:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-347.835:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.870:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.875:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.880:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.883:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.885:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.903:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.916:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.918:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.928:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-345.233:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.274:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.287:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.299:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.338:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.362:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.405:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.419:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.431:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.449:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-348.519:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-349.585:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.593:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.602:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.625:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.633:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-351.652:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-352.687:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.690:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.692:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.715:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.730:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.732:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.743:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.334:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.336:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.347:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.355:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.376:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.385:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.398:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.402:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.439:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-358.439:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-359.440:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-360.460:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-362.473:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.476:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.478:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.498:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.511:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.529:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.531:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.545:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-20 16:16

Updated : 2026-08-25 15:43


NVD link : CVE-2026-26081

Mitre link : CVE-2026-26081

CVE.ORG link : CVE-2026-26081


JSON object : View

Products Affected

haproxy

  • aloha
  • haproxy
  • haproxy_enterprise
CWE
CWE-130

Improper Handling of Length Parameter Inconsistency