CVE-2026-26081

Опубликовано: 20 июл. 2026

Источник: nvd

CVSS3: 4.8

EPSS Низкий

Описание

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Ссылки

https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=4765277f4f915baac2d57db63538ff0a59966deb
Patch
Vendor Advisory
https://www.haproxy.org
Product

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*

Версия от 3.0.0 (включая) до 3.0.16 (исключая)

cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*

Версия от 3.1 (включая) до 3.1.14 (исключая)

cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*

Версия от 3.2 (включая) до 3.2.12 (исключая)

cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:*

Версия от 3.3 (включая) до 3.3.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:*

Версия от 16.5.0.0 (включая) до 16.5.30 (исключая)

cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:*

Версия от 17.0.0 (включая) до 17.0.18 (исключая)

cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:*

Версия от 17.5.0 (включая) до 17.5.16 (исключая)

Конфигурация 3

Одно из

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.363:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.390:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.394:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.395:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.405:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.415:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.455:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.466:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.471:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-341.475:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-342.482:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.495:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.503:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.561:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.564:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.591:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.608:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.641:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.655:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.672:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-345.673:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.792:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.795:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.800:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.803:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.810:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.834:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-347.835:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.870:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.875:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.880:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.883:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.885:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.903:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.916:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.918:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.928:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-345.233:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.274:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.287:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.299:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.338:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.362:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.405:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.419:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.431:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.449:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-348.519:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-349.585:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.593:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.602:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.625:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.633:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-351.652:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-352.687:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.690:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.692:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.715:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-353.730:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.732:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-354.743:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.334:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.336:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.347:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.355:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.376:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.385:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-353.398:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.402:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-354.439:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-358.439:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-359.440:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-360.460:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-362.473:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.476:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.478:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.498:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-363.511:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.529:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.531:*:*:*:*:*:*

cpe:2.3:a:haproxy:haproxy_enterprise:3.2r1:1.0.0-365.545:*:*:*:*:*:*

EPSS

Процентиль: 40%

0.00476

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-130

Связанные уязвимости

CVE-2026-26081

CVSS3: 4.8

ubuntu

2 месяца назад

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

CVE-2026-26081

CVSS3: 4.8

redhat

2 месяца назад

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

CVE-2026-26081

CVSS3: 4.8

msrc

2 месяца назад

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

CVE-2026-26081

CVSS3: 4.8

debian

2 месяца назад

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length ...

ROS-20260922-80-0148

CVSS3: 4.8

redos

3 дня назад

Уязвимость haproxy2

EPSS

Процентиль: 40%

0.00476

Низкий

4.8 Medium

CVSS3

Дефекты

CWE-130