How severe is CVE-2026-26080?

CVE-2026-26080 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2026-26080 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-26080?

CVE-2026-26080 primarily affects Haproxy. In total, 22 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-26080?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-26080 published?

CVE-2026-26080 was published on 2026-07-20 and last updated on 2026-08-25.

CVE-2026-26080

CVE-2026-26080 is a low-severity vulnerability in Haproxy with a CVSS 3.x base score of 3.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-252.

Key facts

Severity: Low (CVSS 3.x base score 3.7)
EPSS exploit prediction: 1% (44th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-252
Affected product: Haproxy
Published: 2026-07-20
Last modified: 2026-08-25

Description

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

Frequently asked questions

What is CVE-2026-26080?: HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.
How severe is CVE-2026-26080?: CVE-2026-26080 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2026-26080 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (44th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-26080?: CVE-2026-26080 primarily affects Haproxy. In total, 22 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-26080?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-26080 published?: CVE-2026-26080 was published on 2026-07-20 and last updated on 2026-08-25.

References

Affected products (22)

cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*
cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.334:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.336:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.347:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.355:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.376:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.385:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.398:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.402:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.439:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-358.439:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-359.440:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-360.460:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-362.473:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.476:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.478:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.498:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.511:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.529:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.531:*:*:*:*:*:*
cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.545:*:*:*:*:*:*

More vulnerabilities in Haproxy

CVE-2019-19330 — Critical (CVSS 9.8): The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII…
CVE-2023-25725 — Critical (CVSS 9.1): HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some…
CVE-2020-11100 — High (CVSS 8.8): In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can…
CVE-2023-45539 — High (CVSS 8.2): HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive…
CVE-2026-55204 — High (CVSS 7.5): HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in…
CVE-2026-55203 — High (CVSS 7.5): HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's…

All CVEs affecting Haproxy →

Other CWE-252 vulnerabilities

CVE-2025-66565 — Critical (CVSS 9.8): Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's…
CVE-2023-52687 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel - Add error handling for…
CVE-2021-38171 — Critical (CVSS 9.8): adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4 does not check the init_get_bits return value, which is a…
CVE-2021-26955 — Critical (CVSS 9.8): An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because…
CVE-1999-0199 — Critical (CVSS 9.8): manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return…
CVE-2019-15900 — Critical (CVSS 9.8): An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without…

Browse all CWE-252 vulnerabilities →