CVE-2026-26080

LowCVSS 3.7

Published: 20/07/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

34th percentile - higher than 34% of all known CVEs

Summary

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

Risk Assessment

This vulnerability can lead to denial of service (DoS) by looping or crashing HAProxy, disrupting application traffic.

Recommendation

Upgrade HAProxy to version 3.3.3 or later.

Original NVD description (English source)

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.