Aloha (Haproxy) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 357 known versions, newest CVE from 2026-07-20. Vendor: Haproxy.

CVEs of Aloha

• CVE-2026-26081 - CVSS 4.8 (medium), 2026-07-20: HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
• CVE-2026-26080 - CVSS 3.7 (low), 2026-07-20: HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also…
• CVE-2026-55204 - CVSS 8.7 (high), 2026-06-18: HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to…
• CVE-2026-55203 - CVSS 9.1 (critical), 2026-06-18: HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse…