CVE-2026-26080

A flaw was found in HAProxy. An attacker can exploit a vulnerability where the software mishandles varint (variable-length integer encoding). This can cause HAProxy to enter an infinite loop or crash, leading to a denial of service for affected systems.

HAProxy versions 3.2.0 through 3.2.11 and 3.3.0 through 3.3.2 contain a flaw in QUIC frame parsing where a malformed, truncated varint (variable-length integer) causes the frame parser to enter an infinite loop, or in some cases crash the process, resulting in a denial of service. This issue is limited to HAProxy's QUIC transport support, which was introduced starting with the 3.2 release series.

No version of HAProxy shipped in a Red Hat product reaches the affected 3.2.x or 3.3.x release series; all Red Hat HAProxy packages predate this code. Red Hat products are therefore not affected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is required. No Red Hat product ships an affected version of HAProxy.