# CVE-2026-26080: HAProxy denial of service via varint mishandling in QUIC parsing

Source: https://junglewise.ai/threats/cve-2026-26080-haproxy-denial-of-service-via-varint-mishandling-in-quic-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-26080 · Severity: low · CVSS 3.7 · Published 2026-07-20

HAProxy is a high-performance load balancer used to distribute network traffic across multiple servers. A vulnerability in how the software handles specific data types could allow an attacker to cause the service to crash or enter an infinite loop. This would result in a denial-of-service condition, preventing legitimate users from accessing the applications protected by the load balancer.

Vendors: [HAProxy](https://junglewise.ai/threats/vendors/haproxy).

## Quick answers

**Is CVE-2026-26080 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26080 being exploited in the wild.

**How severe is CVE-2026-26080?** Low severity, with a CVSS score of 3.7, published 20 July 2026.

**Which products and versions are affected?** HAProxy ALOHA Affected; HAProxy Community Edition 3.2.x before 3.2.12, 3.3.x before 3.3.3; HAProxy Enterprise Affected.

**Is there a fix for CVE-2026-26080?** A patch was published on 2026-02-12: Fixed versions 3.0.12, 3.1.14, 3.2.12, and 3.3.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26080 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-26080?** Check whether you run HAProxy ALOHA, HAProxy Community Edition or HAProxy Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in HAProxy versions 3.2.x and 3.3.x (before 3.3.3) due to the mishandling of variable-length integers (varints) within the QUIC protocol parsing logic. The root cause is identified as an unchecked return value (CWE-252) during the processing of specially crafted QUIC packets. An unauthenticated remote attacker can exploit this by sending malicious packets, causing the process to either enter an infinite loop or crash. This results in a partial loss of availability. The issue is resolved in HAProxy versions 3.0.12, 3.1.14, 3.2.12, and 3.3.3.

## Affected products

- HAProxy HAProxy Community Edition 3.2.x before 3.2.12, 3.3.x before 3.3.3
- HAProxy HAProxy Enterprise Affected
- HAProxy ALOHA Affected

## Timeline

- 2026-02-12: disclosed: Vulnerability reported and announced by HAProxy team
- 2026-02-12: patched: Fixed versions 3.0.12, 3.1.14, 3.2.12, and 3.3.3 released
- 2026-07-20: advisory: NVD publication date

## References

- [https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=5bb098ce8a656ec5711b4de3e4c87f12b216e7a1](https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=5bb098ce8a656ec5711b4de3e4c87f12b216e7a1)
- [https://www.haproxy.org/](https://www.haproxy.org/)

## Related threats

- [HAProxy missing length check in NEW_TOKEN format handling](https://junglewise.ai/threats/cve-2026-26081-haproxy-missing-length-check-in-new-token-format-handling)