redhat/rhceph-ci/haproxy vulnerabilities

Latest redhat/rhceph-ci/haproxy CVEs

Newest publication first

1. CVE-2026-90678 haproxy: HAProxy: HTTP Request Smuggling via HTTP/3 Multiplexer Desynchronization

   Published 2026-09-13

   High·CVSS 7.5 EPSS 0.77%

   An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using c...

2. CVE-2026-26080 HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

   Published 2026-07-20

   Low·CVSS 3.7 EPSS 0.55%

   HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

3. CVE-2026-26081 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

   Published 2026-07-20

   Medium·CVSS 4.8 EPSS 0.48%

   HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

4. CVE-2026-55204 HAProxy - NULL Pointer Dereference in hpack_dht_insert Function

   Published 2026-06-18

   High·CVSS 8.7 EPSS 0.48%

   HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic ta...

5. CVE-2026-55203 HAProxy - Integer Overflow in FCGI Demux Record Length Field

   Published 2026-06-18

   Critical·CVSS 9.0 EPSS 0.33%

   HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When contentLength is 65535 and paddingLength is 1 or more, the drl field wraps to 0, causing...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.