CVE-2026-26081 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes (and More)

February 2026 — CVE-2026-26080 and CVE-2026-26081: QUIC denial of service

Debian DSA-6130-1 Deep Dive: HAProxy QUIC Denial of Service – Technical Analysis, Mitigation, and Performance Retention

SB2026021280 - Ubuntu update for haproxy

Multiples vulnérabilités dans HAProxy (13 février 2026)

USN-8036-1: HAProxy vulnerability

DSA-6130-1 haproxy - security update