HAProxy HAProxy

• CVE-2026-110353 High 7.5 HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does no 0.7%
• CVE-2026-110354 High 7.5 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drai 0.8%
• CVE-2026-90678 High 7.5 An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bi 0.8%
• CVE-2026-26081 Medium 4.8 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected. 0.5%
• CVE-2026-26080 Low 3.7 HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected. 0.5%
• CVE-2026-55204 High 7.5 HAProxy - NULL Pointer Dereference in hpack_dht_insert Function 0.5%
• CVE-2026-55203 High 7.5 HAProxy - Integer Overflow in FCGI Demux Record Length Field 0.3%
• CVE-2026-33555 Medium 4.0 An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with 0.3%
• CVE-2025-32464 Medium 6.8 HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer on 0.8%