CVE-2026-26081 | Medium | 4.8 | 2026-07-20 | HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected. |
CVE-2026-26080 | Low | 3.7 | 2026-07-20 | HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affect… |
CVE-2026-55204 | High | 7.5 | 2026-06-18 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to v… |
CVE-2026-55203 | High | 7.5 | 2026-06-18 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse a… |
CVE-2026-33555 | Medium | 4.0 | 2026-04-13 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length w… |
CVE-2025-11230 | High | 7.5 | 2025-11-19 | Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests. |
CVE-2025-59303 | Medium | 6.4 | 2025-10-08 | HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permi… |
CVE-2025-32464 | Medium | 6.8 | 2025-04-09 | HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of… |
CVE-2024-45506 | High | 7.5 | 2024-09-04 | HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) un… |
CVE-2023-45539 | High | 8.2 | 2023-11-28 | HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impac… |
CVE-2023-40225 | High | 7.2 | 2023-08-10 | HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2… |
CVE-2023-25950 | High | 7.3 | 2023-04-11 | HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a… |
CVE-2023-0836 | High | 7.5 | 2023-03-29 | An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7… |
CVE-2023-0056 | Medium | 6.5 | 2023-03-23 | An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote atta… |
CVE-2023-25725 | Critical | 9.1 | 2023-02-14 | HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP h… |
CVE-2022-0711 | High | 7.5 | 2022-03-02 | A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP respon… |
CVE-2021-40346 | High | 7.5 | 2021-09-08 | An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker… |
CVE-2021-39242 | High | 7.5 | 2021-08-17 | An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host… |
CVE-2021-39241 | Medium | 5.3 | 2021-08-17 | An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space follo… |
CVE-2021-39240 | High | 7.5 | 2021-08-17 | An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI ha… |
CVE-2020-11100 | High | 8.8 | 2020-04-02 | In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain l… |
CVE-2019-19330 | Critical | 9.8 | 2019-11-27 | The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the z… |
CVE-2019-18277 | High | 7.5 | 2019-10-23 | A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly re… |
CVE-2019-14243 | High | 7.5 | 2019-07-23 | headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attac… |
CVE-2019-14241 | High | 7.5 | 2019-07-23 | HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c. |
CVE-2019-11323 | Medium | 5.9 | 2019-05-09 | HAProxy before 1.9.7 mishandles a reload with rotated keys, which triggers use of uninitialized, and very predictable, HMAC keys. This is related to an include… |
CVE-2018-20615 | High | 7.5 | 2019-03-21 | An out-of-bounds read issue was discovered in the HTTP/2 protocol decoder in HAProxy 1.8.x and 1.9.x through 1.9.0 which can result in a crash. The processing… |
CVE-2018-20103 | High | 7.5 | 2018-12-12 | An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recursion by making the… |
CVE-2018-20102 | High | 7.5 | 2018-12-12 | An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating DNS responses, rem… |
CVE-2018-14645 | High | 7.5 | 2018-09-21 | A flaw was discovered in the HPACK decoder of HAProxy, before 1.8.14, that is used for HTTP/2. An out-of-bounds read access in hpack_valid_idx() resulted in a… |
CVE-2018-11469 | Medium | 5.9 | 2018-05-25 | Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9 (if cache enabled) allows attackers to achieve info… |
CVE-2018-10184 | High | 7.5 | 2018-05-09 | An issue was discovered in HAProxy before 1.8.8. The incoming H2 frame length was checked against the max_frame_size setting instead of being checked against t… |
CVE-2016-2102 | Medium | 5.3 | 2017-08-22 | HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network. |
CVE-2016-5360 | High | 7.5 | 2016-06-30 | HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service (uninitialized memory access and crash)… |
CVE-2015-3281 | | | 2015-07-06 | The buffer_slow_realign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which al… |
CVE-2014-6269 | | | 2014-09-30 | Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial… |
CVE-2013-2175 | | | 2013-08-19 | HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote at… |
CVE-2013-1912 | | | 2013-04-10 | Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and… |
CVE-2012-2942 | | | 2012-05-27 | Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21, when global.tune.bufsize is set to a value greater than the d… |