EUVD-2026-45988
GHSA-fhrv-3q89-79q6
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Network vector as HAProxy processes remote client traffic; AC:H for precise varint crafting required; no confidentiality or integrity impact, only limited availability disruption to the HAProxy process itself.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.
AnalysisAI
HAProxy Community Edition 3.2.x and 3.3.x contains a varint mishandling defect that allows remote network clients to trigger an infinite loop or process crash, resulting in denial of service. The flaw affects Community Edition 3.2.x before 3.2.12 and 3.3.x before 3.3.3, and is explicitly confirmed to also affect HAProxy Enterprise and ALOHA commercial distributions. No public exploit has been identified and CISA has not listed this in KEV; however, HAProxy's role as a critical network gateway in many enterprise environments elevates the operational impact of even a Low-severity availability disruption.
Technical ContextAI
HAProxy is a high-performance TCP/HTTP load balancer and reverse proxy widely deployed in enterprise and cloud infrastructure. The defect involves varint (variable-length integer) handling, a compact encoding scheme used in protocols such as HPACK for HTTP/2 header compression and potentially HAProxy's internal wire formats. CWE-252 (Unchecked Return Value) identifies the root cause: HAProxy fails to validate the return value of a varint decoding function, allowing malformed or truncated varint sequences to drive the parser into an unintended infinite loop or crash the process. The upstream fix for the 3.2 branch is publicly referenced as commit 5bb098ce8a at git.haproxy.org, confirming the patch is available for inspection.
RemediationAI
Upgrade HAProxy Community Edition to version 3.2.12 (for 3.2.x deployments) or 3.3.3 (for 3.3.x deployments); the upstream fix commit 5bb098ce8a656ec5711b4de3e4c87f12b216e7a1 on the 3.2 branch is publicly available at git.haproxy.org for review. HAProxy Enterprise and ALOHA users should contact their commercial vendor channel for patched release timelines, as those specific fix versions are not confirmed in the available data. If immediate patching is not feasible, restrict the network sources permitted to send traffic to HAProxy using upstream firewall rules or HAProxy ACLs, limiting exposure to trusted clients less likely to send adversarially crafted input; note this reduces but does not eliminate risk from compromised internal hosts. Additionally, ensure HAProxy is supervised by systemd with Restart=on-failure or equivalent so that any crash triggers an automatic restart, reducing availability impact duration in the event of exploitation.
HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request
A flaw was found in HAProxy before 2.0.6. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, re
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situatio
FastCGI framing desynchronization in HAProxy through 3.4.0 stems from a 16-bit integer overflow in the fcgi_conn demux r
Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 a
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can w
Denial of service in HAProxy through 3.4.0 allows remote unauthenticated attackers to crash worker processes by triggeri
Same weakness CWE-252 – Unchecked Return Value
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today