Description
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HAProxy | HAProxy | 3.0 – < 3.0.12, 3.1 – < 3.1.14, 3.2 – < 3.2.12, 3.3 – < 3.3.3 | 3.0.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | haproxy | 3.2.11-2 | — |
| Debian 13 | haproxy | 3.0.11-1+deb13u2 | DSA-6130-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | haproxy | 3.0.12-0ubuntu0.25.10.3 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | haproxy | 3.0.25-0.1.1.hum1 | RHSA-2026:40938 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 | SUSE-SU-2026:20620-1 |
| SLES 16.0 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 | SUSE-SU-2026:20616-1 |
| SLE Micro 6.2 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 | SUSE-SU-2026:20557-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | haproxy | 3.3.3+git0.465d8e2fc-1.1 | openSUSE-SU-2026:10187-1 |
| openSUSE Leap 16.0 | haproxy | 3.2.12+git0.6011f448e-160000.1.1 | openSUSE-SU-2026:20290-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | haproxy | 2.9.11-8 | — |
Advisories 8
- RHSA-2026:40938 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 6, 2026
- WID-SEC-2026-0410 HAProxy Enterprise, Community und ALOHA (QUIC): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 21, 2026
- openSUSE-SU-2026:20290-1 Security update for haproxy SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2026:10187-1 haproxy-3.3.3+git0.465d8e2fc-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20620-1 Security update for haproxy SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20616-1 Security update for haproxy SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:20557-1 Security update for haproxy SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-6130-1 haproxy - security update Debian Security (DSA / DLA) · Feb 12, 2026