Is CVE-2026-26081 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-26081?

CVE-2026-26081 has a CVSS v3 severity of MEDIUM (4.8).

Back

Description

HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.