CVE-2026-26081: HAProxy NEW_TOKEN Length Check Vulnerability

CVE-2026-26081 Overview

CVE-2026-26081 affects HAProxy Community Edition versions 3.0 through 3.3 before 3.3.3. The vulnerability stems from a missing length check when HAProxy parses the QUIC NEW_TOKEN frame format. HAProxy Enterprise and the HAProxy ALOHA appliance are also affected. The flaw is classified under CWE-130: Improper Handling of Length Parameter Inconsistency. Attackers can reach the vulnerable code path over the network without authentication or user interaction, but successful exploitation requires specific timing conditions.

Critical Impact
Remote attackers can trigger integrity and availability impacts against HAProxy load balancers by sending malformed QUIC NEW_TOKEN data, potentially disrupting traffic routing for downstream services.

Affected Products

HAProxy Community Edition 3.0 through 3.3, before version 3.3.3
HAProxy Enterprise
HAProxy ALOHA

Discovery Timeline

2026-07-20 - CVE-2026-26081 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-26081

Vulnerability Analysis

HAProxy is a widely deployed open-source load balancer and reverse proxy used to front web applications and APIs. CVE-2026-26081 is an improper length handling flaw in the parser for the QUIC transport NEW_TOKEN frame. The parser accepts token data without verifying that the declared length matches the actual buffer size available, violating the [CWE-130] contract for length parameter consistency.

An attacker who negotiates a QUIC connection with a vulnerable HAProxy instance can supply a crafted NEW_TOKEN payload. The mismatch between declared and available data can lead to malformed state within HAProxy, producing limited integrity and availability impact against the proxy process. Confidentiality is not affected according to the published CVSS vector.

Root Cause

The root cause is the absence of a bounds check before HAProxy consumes bytes described by the NEW_TOKEN length field. Without validating the length against remaining frame bytes, the parser trusts attacker-controlled input from a QUIC peer. The upstream fix adds the missing length validation, as recorded in commit 4765277f4f915baac2d57db63538ff0a59966deb on the HAProxy 3.2 branch.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction, but attack complexity is high because the attacker must reach the QUIC listener and align frame parsing conditions to trigger the flaw. HAProxy deployments that expose HTTP/3 or QUIC listeners to untrusted networks present the primary attack surface. Deployments serving only TCP or HTTP/1.1 and HTTP/2 traffic without QUIC are not exposed via this path.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the HAProxy commit adding the length check for the corrected parser logic.

Detection Methods for CVE-2026-26081

Indicators of Compromise

Unexpected crashes or restarts of the haproxy process on hosts serving QUIC or HTTP/3 traffic.
Anomalous QUIC frame patterns targeting the load balancer, particularly repeated malformed NEW_TOKEN frames from the same source.
Sudden drops in backend availability or elevated 5xx responses correlated with QUIC client activity.

Detection Strategies

Inventory HAProxy deployments and identify instances running Community Edition 3.0 through 3.3.2, Enterprise, or ALOHA builds prior to the fix.
Monitor HAProxy logs and process supervisors for repeated worker restarts or abnormal exits tied to QUIC listeners.
Inspect network telemetry for malformed QUIC handshakes or oversized NEW_TOKEN payloads directed at load balancer front ends.

Monitoring Recommendations

Enable verbose QUIC logging on HAProxy where operationally feasible and forward events to a centralized log platform.
Alert on new or unusual QUIC source addresses that generate handshake errors at high rates.
Track HAProxy version and build across the fleet to confirm patched status after remediation.

How to Mitigate CVE-2026-26081

Immediate Actions Required

Upgrade HAProxy Community Edition to version 3.3.3 or later on all affected hosts.
Apply the corresponding HAProxy Enterprise and ALOHA updates provided by HAProxy Technologies.
Restrict exposure of QUIC and HTTP/3 listeners to trusted networks until patching completes.

Patch Information

HAProxy addresses the missing length check in commit 4765277f4f915baac2d57db63538ff0a59966deb, applied to the 3.2 branch and rolled forward into the 3.3.3 release. Refer to the HAProxy commit reference and the HAProxy official website for release announcements. Enterprise and ALOHA customers should obtain corresponding builds from HAProxy Technologies support channels.

Workarounds

Disable QUIC and HTTP/3 bind directives in haproxy.cfg until the patched binary is deployed.
Place upstream network filtering in front of HAProxy to block UDP 443 from untrusted sources.
Rate-limit QUIC handshake attempts at the edge to reduce opportunities for repeated exploitation attempts.

bash

# Configuration example: disable QUIC listener until patched
# In /etc/haproxy/haproxy.cfg, comment out QUIC bind lines:
frontend fe_https
    bind :443 ssl crt /etc/haproxy/certs/site.pem
    # bind quic4@:443 ssl crt /etc/haproxy/certs/site.pem alpn h3
    mode http
    default_backend be_app

# Verify installed version after upgrade
haproxy -vv | head -n 1