HAProxy High Performance TCP/HTTP Load Balancer

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any HAProxy product.

RSS Feeds for HAProxy security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in HAProxy products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by HAProxy Sorted by Most Security Vulnerabilities since 2018

HAProxy32 vulnerabilities

HAProxy Aloha2 vulnerabilities

HAProxy Proxyprotocol1 vulnerability

By the Year

In 2026 there have been 5 vulnerabilities in HAProxy with an average score of 5.5 out of ten. Last year, in 2025 HAProxy had 3 security vulnerabilities published. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 1.45

Year	Vulnerabilities	Average Score
2026	5	5.50
2025	3	6.95
2024	3	7.50
2023	6	7.63
2022	1	7.50
2021	4	6.95
2020	1	0.00
2019	6	5.90
2018	5	0.00

It may take a day or so for new HAProxy vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent HAProxy Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-26081	Jul 20, 2026	Length-Unchecked NEW_TOKEN in HAProxy 3.0-3.3.3 (incl. Enterprise & ALOHA) HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.	Haproxy
CVE-2026-26080	Jul 20, 2026	HAProxy varint mishandling loop/crash 3.23.3 pre 3.3.3 HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.	Haproxy
CVE-2026-55204	Jun 18, 2026	HAProxy 3.4.0 Null Pointer Deref in hpack_dht_insert() DoS HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial of service.	Aloha
CVE-2026-55203	Jun 18, 2026	HAProxy <3.4.0 Integer Overflow in FastCGI Conn drl Field HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing incorrect record consumption and allowing malicious FastCGI backends to desynchronize the FCGI framing parser, potentially causing request routing errors, response smuggling, or memory safety issues.	Aloha
CVE-2026-33555	Apr 13, 2026	HAProxy <3.3.6 HTTP/3 Parser Desynchronization & Request Smuggling An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.	Haproxy
CVE-2025-11230	Nov 19, 2025	HAProxy mjson Denial-of-Service via Designed JSON (CVE-2025-11230) Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.	Haproxy
CVE-2025-59303	Oct 08, 2025	HAProxy K8s Ingress Controller <3.1.13 config-snippets YML Injection HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress Controller are 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1.	Haproxy
CVE-2025-32464	Apr 09, 2025	HAProxy 2.2-3.1.6 Heap Buffer Overflow in sample_conv_regsub HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patterns with a longer one.	Haproxy
CVE-2024-53008	Nov 28, 2024	CVE-2024-53008: HAProxy HTTP SM bypasses ACLs Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.	Haproxy
CVE-2024-49214	Oct 14, 2024	QUIC IP List Bypass in HAProxy 3.1-dev<7, 3.0<5, 2.9<11 QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.	Haproxy