CVE-2026-26080Patch(haproxy / aloha)

LOWCVSS 3.7 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch haproxy aloha systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

haproxy CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=5bb098ce8a656ec5711b4de3e4c87f12b216e7a1

Other references

https://www.haproxy.org

Weakness type (CWE)

CWE-252

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

aloha
haproxy
haproxy_enterprise

Threat summary

Patch or workaround signal is available
5 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 5 signals
Disclosure: 1 classified signal
Disclose: 1 classified signal
Peaked 4d ago at 1 mentions (2026-02-15); latest day: 1
5 total mentions across 5 days

Affected systems

Vendors

haproxy

Products

alohahaproxyhaproxy_enterprise

1 version affected across 3 products

Deep dive

Activity timeline5 mentions / 5d

Signal classification3 categories

Patch

360.0%

Disclosure

120.0%

Disclose

120.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-15	1	Patch1
2026-02-16	1	Patch1
2026-02-28	1	Disclosure1
2026-08-09	1	Disclose1
2026-08-28	1	Patch1

Full discourse5 posts

tetsuo@tetsuoai222d
Disclosure
Proud to have discovered two QUIC-related issues in HAProxy that led to CVE-2026-26080 & CVE-2026-26081 (DoS crashes via malformed packets). Thanks to willyt for the credit in the 3.1.15 release announcement!
Post summary
The author announced the discovery of two QUIC-related DoS vulnerabilities in HAProxy, assigning CVE‑2026‑26080 and CVE‑2026‑26081, and credited the 3.1.15 release announcement to willyt.
161621412216.8K
231.3K followersView on X
connect24h@connect24h60d
Disclose
基幹系のDoS、クラッシュ脆弱性はほんま勘弁して。ロードバランサが落ちる系の話です。HAProxyに停止・クラッシュへつながるCVE-2026-26080とCVE-2026-26081。Community EditionだけでなくEnterpriseとALOHAも影響する。 26080はvarintの不適切な処理でループまたはクラッシュし、対象は3.2.x〜3.3.3未満。26081はNEW_TOKEN formatのlength check欠落で、3.0〜3.3.3未満が対象。通信基盤の可用性を直撃する2件だ。冗長化していても同一versionなら同じ穴を踏む。お盆休みだからと後回しはかなり危ない。 #セキュリティソース: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26080
Post summary
The text alerts that CVE-2026-26080 and CVE-2026-26081 can cause DoS/crashes in HAProxy 3.0‑3.3.3, but offers no patches, exploits, or evidence of active use.
000721.4K
8.4K followersView on X
Gray Hats@the_yellow_fall234d
Patch
HAProxy patches high-severity QUIC flaws CVE-2026-26080 & 26081. Remote attackers can crash servers via malformed packets. Update to v3.0.16 now. #HAProxy #CyberSecurity #QUIC #DoS #DevOps #InfoSec #PatchTuesday https://securityonline.info/haproxy-patches-high-severity-quic-flaws-that-can-kill-the-load-balancer/
Post summary
HAProxy has released v3.0.16 to patch high‑severity QUIC flaws CVE‑2026‑26080 and CVE‑2026‑26081 that could allow remote attackers to crash servers via malformed packets.
01023300
10.3K followersView on X
𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc41d
Patch
Recent ServiceNow flaws (CVSS 10.0) allow unauthenticated RCE/SQLi, threatening data privacy & integrity in transit. Patch immediately! Also, HAProxy QUIC vulnerabilities (CVE-2026-26081, CVE-2026-26080) fixed to prevent crashes. #Cybersecurity #News #Vulnerabilities
Post summary
New ServiceNow RCE/SQLi flaws with high severity are reported – immediate patching is urged; HAProxy QUIC issues have also been fixed to prevent crashes.
0000065
17 followersView on X
Autumn Good@autumn_good_35235d
Patch
『If you use an affected product with the QUIC component enabled, you should update to a fixed version as soon as possible.』 HAProxy February 2026 — CVE-2026-26080 and CVE-2026-26081: QUIC denial of service https://www.haproxy.com/blog/cves-2026-quic-denial-of-service
Post summary
The notice informs users that HAProxy’s QUIC component is vulnerable to CVE‑2026‑26080 and CVE‑2026‑26081, causing denial‑of‑service, and urges them to apply the latest patch.
00000650
6.7K followersView on X

CPE platform detail22 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

22 of 22 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	haproxy	aloha	-	-	-
App	haproxy	haproxy	-	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-
App	haproxy	haproxy_enterprise	3.2r1	-	-

Explore more

Back to dashboard haproxy CVEs aloha vulnerabilities

What researchers are saying

CVE-2026-26080

tetsuo[verified]@tetsuoaiDisclosure

The author announced the discovery of two QUIC-related DoS vulnerabilities in HAProxy, assigning CVE‑2026‑26080 and CVE‑2026‑26081, and credited the 3.1.15 release announcement to willyt.

connect24h[verified]@connect24hDisclose

The text alerts that CVE-2026-26080 and CVE-2026-26081 can cause DoS/crashes in HAProxy 3.0‑3.3.3, but offers no patches, exploits, or evidence of active use.

Gray Hats@the_yellow_fallPatch

HAProxy has released v3.0.16 to patch high‑severity QUIC flaws CVE‑2026‑26080 and CVE‑2026‑26081 that could allow remote attackers to crash servers via malformed packets.

𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_ircPatch

New ServiceNow RCE/SQLi flaws with high severity are reported – immediate patching is urged; HAProxy QUIC issues have also been fixed to prevent crashes.

Autumn Good@autumn_good_35Patch

The notice informs users that HAProxy’s QUIC component is vulnerable to CVE‑2026‑26080 and CVE‑2026‑26081, causing denial‑of‑service, and urges them to apply the latest patch.