CVE-2026-26080: HAProxy varint DOS Vulnerability

CVE-2026-26080 Overview

CVE-2026-26080 is a denial-of-service vulnerability in HAProxy Community Edition versions 3.2.x through 3.3.x before 3.3.3. The flaw stems from mishandling of variable-length integer (varint) decoding, which can drive the load balancer into a loop or trigger a crash. HAProxy Enterprise and the ALOHA appliance are also affected. The weakness is classified as [CWE-252] (Unchecked Return Value). Because HAProxy is deployed as a reverse proxy and load balancer in front of production workloads, a crash disrupts traffic delivery for all backends behind the affected instance.

Critical Impact
A remote attacker can send crafted input that triggers a loop or process crash in HAProxy, degrading availability of proxied services without requiring authentication.

Affected Products

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3
HAProxy Enterprise
HAProxy ALOHA

Discovery Timeline

2026-07-20 - CVE-2026-26080 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-26080

Vulnerability Analysis

HAProxy uses variable-length integer (varint) encoding to represent numeric values compactly on the wire, including within HTTP/2 and HTTP/3 (QUIC) processing paths. The affected code paths decode varint values from attacker-controllable input without correctly validating the return status of the decoding routine. When malformed input is supplied, the decoder can return an error indicator that the caller ignores, causing the parser to either loop indefinitely on the same buffer position or dereference state that leads to a process crash.

The result is a availability-only impact: no data confidentiality or integrity guarantees are broken, but the proxy stops forwarding legitimate traffic. In deployments where a single HAProxy instance fronts multiple services, the outage cascades to every backend behind it.

Root Cause

The root cause is an unchecked return value [CWE-252] from the varint decoding helper. The caller proceeds as if decoding succeeded, so an invalid encoding is treated as valid data. Depending on the specific call site, this either advances no bytes (producing an infinite loop) or leaves internal length and offset fields inconsistent (producing a crash).

Attack Vector

An unauthenticated remote attacker sends a crafted request containing a malformed varint field to any listener that reaches the vulnerable decoding path. No user interaction is required. Attack complexity is elevated because the attacker must shape the encoding to reach the specific unchecked path, but no privileges or session state are required.

The upstream fix is captured in the HAProxy Commit Update, which adds the missing return-value check around the varint decode call site and rejects the malformed frame instead of continuing to parse.

Detection Methods for CVE-2026-26080

Indicators of Compromise

Unexpected termination of the haproxy worker process with segmentation faults recorded in dmesg or systemd-journald.
HAProxy stats socket reporting elevated Process_num restarts or worker CPU pinned at 100% on a single thread with no corresponding traffic increase.
Client-side symptoms of connection resets, 502/504 responses, or stalled HTTP/2 or QUIC streams originating from a single upstream IP.

Detection Strategies

Monitor HAProxy master-worker logs for [ALERT] entries indicating worker exit or automatic respawn.
Alert on abnormal restart counters exposed through the Runtime API (show info command) and Prometheus exporter metrics.
Correlate crash events with source IPs performing HTTP/2 or HTTP/3 requests using packet capture on affected listeners.

Monitoring Recommendations

Track process uptime and restart counts per HAProxy instance and alert on any restart outside change windows.
Baseline per-thread CPU usage and alert when a single thread saturates while request throughput drops.
Ingest HAProxy logs into a centralized platform and build a rule for repeated worker crash messages from the same client.

How to Mitigate CVE-2026-26080

Immediate Actions Required

Upgrade HAProxy Community Edition to 3.3.3 or later on all affected instances.
Contact HAProxy Technologies for fixed builds of HAProxy Enterprise and ALOHA and schedule maintenance windows to apply them.
Inventory all HAProxy nodes, including sidecar and ingress deployments in Kubernetes, to ensure no vulnerable version is missed.

Patch Information

The upstream fix adds a check on the varint decoder's return value and is available in the HAProxy Commit Update. Fixed community releases start at 3.3.3. Refer to the HAProxy Official Website for release notes and enterprise advisories.

Workarounds

Disable HTTP/2 and HTTP/3 listeners on internet-facing frontends until patched builds are deployed, forcing clients to HTTP/1.1.
Place a rate limiter or upstream WAF in front of HAProxy to constrain request volume from any single source and blunt crash-loop attacks.
Enable HAProxy's master-worker mode with automatic worker respawn (master-worker in the global section) to reduce outage duration while patches are staged.

bash

# Verify installed HAProxy version and upgrade on Debian/Ubuntu
haproxy -v
sudo apt-get update && sudo apt-get install --only-upgrade haproxy

# Confirm the fixed version is running
haproxy -v | grep -E '3\.(3\.[3-9]|[4-9])'

# Reload without dropping connections
sudo systemctl reload haproxy