IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
4.8Orta

CVE-2026-26081

HAProxy HAProxy Yayım: (3 ay önce)

Açıklama

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Zayıflık türü (CWE): CWE-130

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
haproxy aloha 16.5.0.0 – < 16.5.30
HAProxy HAProxy 3.0 – < 3.0.12, 3.1 – < 3.1.14, 3.2 – < 3.2.12, 3.3 – < 3.3.3
haproxy haproxy enterprise 3.0r1

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (60)
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.0.16
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.1 < 3.1.14
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.2 < 3.2.12
  • cpe:2.3:a:haproxy:haproxy:*:*:*:*:*:*:*:* ≥ 3.3 < 3.3.3
  • cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:* ≥ 16.5.0.0 < 16.5.30
  • cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:* ≥ 17.0.0 < 17.0.18
  • cpe:2.3:a:haproxy:aloha:*:*:*:*:*:*:*:* ≥ 17.5.0 < 17.5.16
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.363:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.390:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-337.394:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.395:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.405:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.415:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.455:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.466:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-339.471:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-341.475:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-342.482:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.495:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.503:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.561:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.564:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.591:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.608:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.641:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.655:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-344.672:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-345.673:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.792:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.795:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.800:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.803:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.810:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-346.834:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-347.835:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.870:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-348.875:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.880:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.883:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.885:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.903:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-349.916:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.918:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.0r1:1.0.0-350.928:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-345.233:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.274:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-346.287:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.299:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.338:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.362:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.405:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.419:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.431:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-347.449:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-348.519:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-349.585:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.593:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.602:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.625:*:*:*:*:*:*
  • cpe:2.3:a:haproxy:haproxy_enterprise:3.1r1:1.0.0-350.633:*:*:*:*:*:*

Aynı üründe son açıklar — HAProxy

7.5Yüksek
CVE-2026-110353
HAProxy HAProxy; HAProxy HAProxy Enterprise Edition; HAProxy Kubernetes Ingress Controller; Haproxy Kubernetes Ingress Controller Enterprise

HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handler…

7.5Yüksek
CVE-2026-110354
HAProxy HAProxy; HAProxy HAProxy Enterprise Edition; HAProxy Technologies HAProxy Kubernetes Ingress Controller; HAProxy Technologies Kubernetes Ingress Controller Enterprise

HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeat…

7.5Yüksek
CVE-2026-90678
HAProxy HAProxy

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend …

3.7Düşük
CVE-2026-26080
HAProxy HAProxy

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

7.5Yüksek
CVE-2026-55203

HAProxy - Integer Overflow in FCGI Demux Record Length Field

haproxy haproxy

HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field…