3.7

CVE-2026-26080: haproxy aloha Unchecked Return Value

CVSS: 3.7v3.1LowAnalyzed
AliasesDEBIAN-CVE-2026-26080
Published 20-07-2026Last modified 20-07-2026
Open JSON

Vulnerability summary

CVE-2026-26080 is a low (CVSS 3.7) Unchecked Return Value vulnerability in haproxy aloha. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.9% of scored vulnerabilities.

Overall risk
15/100
0100
Low · default modelHow is this calculated?
CVSS score
3.7/10
010
Low · v3.1 (CVE.org)
EPSS score
0.55%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 4
OPENSUSE-SU-2026:20290-1RHSA-2026:40938SUSE-SU-2026:20557-1SUSE-SU-2026:20616-1SUSE-SU-2026:20620-1

Timeline

  1. 20-07-2026
    PublishedVulnerability first disclosed.
  2. 20-07-2026
    Last modifiedVulnerability information updated.

Description

HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.55%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

0.00 pp

From 0.55% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.55%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Haproxy3 products
  • aloha≥ 17.0.0, < 17.0.18 | ≥ 17.5.0, < 17.5.16
  • haproxy≥ 3.2, < 3.2.12 | ≥ 3.3, < 3.3.3
  • haproxy_enterprise3.2r1:1.0.0-353.334 | 3.2r1:1.0.0-353.336 | 3.2r1:1.0.0-353.347 | 3.2r1:1.0.0-353.355 | 3.2r1:1.0.0-353.376 | 3.2r1:1.0.0-353.385 | 3.2r1:1.0.0-353.398 | 3.2r1:1.0.0-354.402 | 3.2r1:1.0.0-354.439 | 3.2r1:1.0.0-358.439 | 3.2r1:1.0.0-359.440 | 3.2r1:1.0.0-360.460 | 3.2r1:1.0.0-362.473 | 3.2r1:1.0.0-363.476 | 3.2r1:1.0.0-363.478 | 3.2r1:1.0.0-363.498 | 3.2r1:1.0.0-363.511 | 3.2r1:1.0.0-365.529 | 3.2r1:1.0.0-365.531 | 3.2r1:1.0.0-365.545
Debian1 product
  • haproxy< 3.2.11-2

2 vendors · 4 products

References

3 links