HAProxy Technologies
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| HAProxy | 1 | – | Apr 11, 2023 |
| HAProxy Community Edition | 1 | – | Nov 19, 2025 |
| HAProxy Kubernetes Ingress Controller | 1 | – | Oct 22, 2026 |
| Kubernetes Ingress Controller Enterprise | 1 | – | Oct 22, 2026 |
Exploited and recent CVEs
- CVE-2026-110354 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drai 0.8%
- CVE-2026-110354 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drai 0.8%
- CVE-2025-11230 Denial of service vulnerability in HAProxy mjson library 0.7%
- CVE-2023-25950 HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive 3.0%