Executive brief
HAProxy is a high-performance load balancer used to distribute network traffic across multiple servers. A vulnerability in how the software handles specific data types could allow an attacker to cause the service to crash or enter an infinite loop. This would result in a denial-of-service condition, preventing legitimate users from accessing the applications protected by the load balancer.
Technical details
A vulnerability exists in HAProxy versions 3.2.x and 3.3.x (before 3.3.3) due to the mishandling of variable-length integers (varints) within the QUIC protocol parsing logic. The root cause is identified as an unchecked return value (CWE-252) during the processing of specially crafted QUIC packets. An unauthenticated remote attacker can exploit this by sending malicious packets, causing the process to either enter an infinite loop or crash. This results in a partial loss of availability. The issue is resolved in HAProxy versions 3.0.12, 3.1.14, 3.2.12, and 3.3.3.
Affected products
- HAProxy HAProxy Community Edition 3.2.x before 3.2.12, 3.3.x before 3.3.3
- HAProxy HAProxy Enterprise Affected
- HAProxy ALOHA Affected
Timeline
- 2026-02-12: disclosed: Vulnerability reported and announced by HAProxy team
- 2026-02-12: patched: Fixed versions 3.0.12, 3.1.14, 3.2.12, and 3.3.3 released
- 2026-07-20: advisory: NVD publication date