Haproxy - vulnerabilities (CVEs)

44 CVEs in 11 products, 3 in the last 30 days, newest from 2026-10-22.

Products

• Haproxy - 38 CVEs
• Aloha - 4 CVEs
• Haproxy Enterprise - 3 CVEs
• Haproxy Enterprise Edition - 2 CVEs
• Aloha Appliance - 1 CVEs
• Data Plane Api Ce - 1 CVEs
• Data Plane Api Ee - 1 CVEs
• Haproxy Kubernetes Ingress Controller - 1 CVEs
• Kubernetes Ingress Controller - 1 CVEs
• Kubernetes Ingress Controller Enterprise - 1 CVEs
• Proxyprotocol - 1 CVEs

Newest CVEs of Haproxy

• CVE-2026-110353 - CVSS 7.5 (high), 2026-10-22: HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING…
• CVE-2026-110354 - CVSS 7.5 (high), 2026-10-22: HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked…
• CVE-2026-109575 - CVSS 9.8 (critical), 2026-10-12: In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic…
• CVE-2026-90678 - CVSS 7.5 (high), 2026-09-13: An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with…
• CVE-2026-26080 - CVSS 3.7 (low), 2026-07-20: HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also…
• CVE-2026-26081 - CVSS 4.8 (medium), 2026-07-20: HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
• CVE-2026-55204 - CVSS 8.7 (high), 2026-06-18: HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to…
• CVE-2026-55203 - CVSS 9.1 (critical), 2026-06-18: HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse…
• CVE-2026-33555 - CVSS 5.8 (medium), 2026-04-13: An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length…
• CVE-2025-11230 - CVSS 7.5 (high), 2025-11-19: Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
• CVE-2025-59303 - CVSS 6.4 (medium), 2025-10-08: HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update…
• CVE-2025-32464 - CVSS 6.8 (medium), 2025-04-09: HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement…
• CVE-2024-53008 - CVSS 5.3 (medium), 2024-11-28: Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote…
• CVE-2024-45506 - CVSS 7.5 (high), 2024-09-04: HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop)…
• CVE-2023-45539 - CVSS 8.2 (high), 2023-11-28: HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other…
• CVE-2023-40225 - CVSS 7.2 (high), 2023-08-10: HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before…
• CVE-2023-25950 - CVSS 7.3 (high), 2023-04-11: HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a…
• CVE-2023-0836 - CVSS 7.5 (high), 2023-03-29: An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before…
• CVE-2023-0056 - CVSS 6.5 (medium), 2023-03-23: An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote…
• CVE-2023-25725 - CVSS 9.1 (critical), 2023-02-14: HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP…
• CVE-2022-0711 - CVSS 7.5 (high), 2022-03-02: A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP…
• CVE-2021-40346 - CVSS 7.5 (high), 2021-09-08: An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an…
• CVE-2021-39241 - CVSS 5.3 (medium), 2021-08-17: An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space…
• CVE-2021-39240 - CVSS 7.5 (high), 2021-08-17: An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI…
• CVE-2021-39242 - CVSS 7.5 (high), 2021-08-17: An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP…
• CVE-2020-11100 - CVSS 8.8 (high), 2020-04-02: In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain…
• CVE-2019-19330 - CVSS 9.8 (critical), 2019-11-27: The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the…
• CVE-2019-18277 - CVSS 7.5 (high), 2019-10-23: A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly…
• CVE-2019-14243 - CVSS 7.5 (high), 2019-07-23: headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote…
• CVE-2019-14241 - CVSS 7.5 (high), 2019-07-23: HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.