PT-2026-7983 · Haproxy · Haproxy

CVE-2026-26081 · Published 2026-01-01 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions HAProxy (affected versions not specified)

Description HAProxy is susceptible to a denial of service. A remote attacker may be able to cause HAProxy to crash by sending specially crafted INITIAL packets, specifically those using the NEW TOKEN format.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-130

Related Identifiers

CVE-2026-26081

OPENSUSE-SU-2026:10187-1

OPENSUSE-SU-2026:20290-1

SUSE-SU-2026:20557-1

SUSE-SU-2026:20616-1

SUSE-SU-2026:20620-1

USN-8036-1

Affected Products

Haproxy

References · 26

• https://osv.dev/vulnerability/SUSE-SU-2026:20557-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26081 · Security Note
• https://ubuntu.com/security/CVE-2026-26081 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8036-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20620-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20616-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26081 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20290-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-26081 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8036-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26081 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10187-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26081 · Vendor Advisory
• https://twitter.com/autumn_good_35/status/2023038021676007824 · Twitter Post
• https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=4765277f4f915baac2d57db63538ff0a59966deb · Note