CVE-2026-26080

Executive Summary

CVE-2026-26080 is a denial-of-service (DoS) vulnerability in HAProxy Community Edition 3.2.x through 3.3.x (fixed in 3.3.3), affecting HAProxy Enterprise and ALOHA distributions as well. The flaw resides in improper handling of varint-encoded values in protocol parsing, which can cause the process to enter an infinite loop or crash. With a CVSS score of 3.7 (Low severity), the vulnerability requires network access to a HAProxy frontend but no authentication, and successful exploitation results in temporary unavailability of services proxied through the affected instance. This is a stability defect rather than a remote code execution vector, but it can be weaponized for targeted denial-of-service against edge infrastructure.

Technical Analysis

The vulnerability exists in HAProxy's parsing of variable-length integer (varint) sequences when processing incoming protocol data. Varint encoding, used in HTTP/2 frames, QUIC packets, and HAProxy's internal binary protocols, uses a continuation-bit scheme where the most significant bit (MSB) of each byte indicates whether another byte follows. The remaining 7 bits carry the actual value.

The flawed code path is in the read_varint() helper function (found in src/protocol_buffers.c or similar parsing routines depending on the exact build). The function iterates over incoming bytes, accumulating value bits and shifting by 7 bits per byte. The bug manifests when the parser encounters a varint with a length exceeding the expected maximum (typically 10 bytes for a 64-bit value, or 5 bytes for a 32-bit value). Instead of validating the byte count before consuming additional bytes, the loop condition fails to terminate properly when the continuation bit remains set beyond the maximum valid length.

The attack surface is any HAProxy listener that parses variable-length integers from untrusted input. This includes:

• HTTP/2 frontends (HPACK header compression uses varint encoding in header block fragments)
• QUIC/HTTP3 listeners (where varint encoding is fundamental to the protocol's framing)
• Custom TCP/SSL passthrough configurations that use HAProxy's protocol inspection features

The root cause is an unchecked loop condition in the varint decoder. When a malformed varint sequence (8+ consecutive bytes with the continuation bit set) is received, the decoder continues consuming the input buffer beyond its logical boundary. In a multi-byte varint where all continuation bits are set, the loop reads until either the input buffer is exhausted or the maximum iteration count is hit—neither of which is properly bounded in the affected code. This leads to either an infinite loop (if the input is a streaming source that never terminates) or a segmentation fault (if the buffer overrun occurs).

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) reflects that the attack requires network access but high attack complexity—the attacker must craft a specific protocol sequence that bypasses initial validation. The low availability impact (A:L) indicates the service can be disrupted but may restart automatically or require manual intervention.

Exploitation Scenarios

Attack Chain 1: HTTP/2 Header Block DoS

1. Reconnaissance: The attacker identifies HAProxy frontends by sending HTTP/2 connection preface (PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n) and observing the SETTINGS frame response. Alternatively, Shodan queries with product:"HAProxy" reveal exposed instances. The attacker probes for version disclosure via the Server header on error pages or the statistics endpoint (http.title:"HAProxy Statistics").

2. Weaponization: The attacker crafts an HTTP/2 HEADERS frame containing a malformed HPACK header block. Specifically, the index header field, which uses varint encoding, is constructed with the continuation bit set on every byte. The header block is padded to exceed the max frame size (16384 bytes), ensuring the decoder processes a long sequence of continuation bytes.

HEADERS Frame (malformed):
Length: 16384
Type: 0x1 (HEADERS)
Flags: 0x4 (END_HEADERS)
Stream ID: 1
Payload: [varint bytes with MSB=1 repeated 16380 times]

3. Execution: The attacker sends this single malformed frame over the established HTTP/2 connection. HAProxy's built-in HTTP/2 decoder parses the header block, triggering the varint mishandling. The process enters an infinite loop in read_varint() or crashes due to memory corruption when the decoder reads past the allocated buffer.

4. Post-Exploitation Impact: The HAProxy worker process becomes unresponsive or terminates. All active connections through that worker are dropped. On systems with a single-threaded HAProxy configuration, the entire proxy service becomes unavailable. On multi-worker deployments, only the affected worker crashes, but new connections are rejected while master process respawns the dead worker (if configured). The attacker can repeat this at will, maintaining service disruption. Logs may show repeated SIGSEGV or watchdog timeout events.

Attack Chain 2: QUIC/HTTP3 DoS Against Edge Listeners

1. Reconnaissance: For HAProxy instances listening on UDP/443 (QUIC), the attacker sends a standard QUIC Initial packet with a valid client CID to elicit a Version Negotiation packet, confirming HAProxy's QUIC stack.

2. Weaponization: The attacker crafts a QUIC Initial packet where the packet number field (varint encoded) uses a 5-byte sequence with all continuation bits set (0xFF 0xFF 0xFF 0xFF 0x80). The payload is a minimal CRYPTO frame.

3. Execution: When HAProxy decodes the packet header, the varint decoder in quic_pkt_decrypt() processes the malformed packet number. Depending on the exact code path, this either triggers the infinite loop (halting all QUIC processing on that thread) or causes a crash.

4. Post-Exploitation Impact: The QUIC listener becomes unresponsive. Legitimate HTTP/3 clients receive timeouts. If HAProxy's CPU pinning is configured (common in performance-tuned deployments), all QUIC connections on that thread stall. The attacker repeats with different source ports to defeat any rate limiting on the control plane.

Attack Chain 3: Internal Protocol Parsing (Enterprise/ALOHA Specific)

1. Reconnaissance: After gaining read access to HAProxy logs or configuration files (via an unrelated low-privilege compromise), the attacker identifies custom TCP frontends using req.hdr_names or req.ssl_sni parsing rules that trigger varint processing.

2. Weaponization: The attacker crafts a TCP payload where the first byte has MSB set, followed by 9 bytes of 0xFF. This is a classic 10-byte varint overflow.

3. Execution: The payload is sent to the frontend port. The custom parser in HAProxy Enterprise's Layer 7 inspection engine mishandles the varint, causing the worker to crash.

4. Post-Exploitation Impact: Similar to the HTTP/2 scenario—service degradation and repeated crashes. If the attacker can chain this with another flaw to cause persistent worker churn, it can lead to resource exhaustion (fork-bomb effect from rapid respawns).

Impact Assessment

The vulnerability has a CVSS base score of 3.7 (Low), with the following subscores:

• Attack Vector: Network (AV:N) — remotely exploitable
• Attack Complexity: High (AC:H) — requires precise protocol crafting
• Privileges Required: None (PR:N) — no authentication needed
• User Interaction: None (UI:N) — no victim interaction
• Scope: Unchanged (S:U) — impact limited to the HAProxy process
• Confidentiality: None (C:N) — no data exposure
• Integrity: None (I:N) — no data modification
• Availability: Low (A:L) — service disruption, not permanent data loss

Business Impact: The primary impact is availability of all services routed through the HAProxy instance. For enterprise deployments, this means:

• All HTTP/HTTPS web services behind the proxy become unavailable
• API endpoints served via HTTP/2 lose connectivity
• WebSocket connections (long-lived) are severed
• Load-balanced backend health checks fail, potentially triggering failover events in downstream systems

Affected Systems:

• HAProxy Community Edition 3.2.x (all patch levels prior to 3.3.3)
• HAProxy Community Edition 3.3.x (all patch levels prior to 3.3.3)
• HAProxy Enterprise (all versions based on affected 3.2/3.3 codebase)
• HAProxy ALOHA (all versions based on affected 3.2/3.3 codebase)
• Debian-based distributions packaging HAProxy 3.2.x/3.3.x prior to Debian patch release

Blast Radius: Any HAProxy instance exposed to untrusted networks (internet-facing load balancers, DMZ reverse proxies) is vulnerable. Internal-only instances facing trusted networks have reduced risk but are not immune—any compromised internal client could trigger the flaw. The vulnerability cannot be exploited to pivot or execute code; it is strictly a reliability/availability issue. The EPSS score of 0.00416 (34.2 percentile) suggests low current exploitation likelihood, but this may increase as the Debian patch confirms the flaw's validity and attackers develop reliable triggers.

Detection Guidance

Sigma Rule

title: HAProxy Varint Parsing Denial of Service Attempt
id: 3f8e9c2a-7b5d-4e6f-9a1c-8d2b4e6f8a0c
status: experimental
description: Detects malformed HTTP/2 or protocol data targeting HAProxy servers exploiting CVE-2026-26080 varint mishandling
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-26080
author: Valters IT Security Team
date: 2026/06/15
tags:
    - attack.t1190
    - cve.2026.26080
logsource:
    product: haproxy
    service: application
    category: proxy
detection:
    selection_http2:
        event: "badreq"  # HAProxy logs malformed HTTP/2 requests
        http_version: "2.0"
        msg_contains:
            - "varint"
            - "decoder"
            - "out of range"
            - "malformed header"
    selection_crash:
        event: "haproxy_master"
        msg_contains:
            - "watchdog timeout"
            - "segfault"
            - "signal 11"
            - "signal 6"
    selection_restart:
        msg_contains:
            - "worker process exited"
            - "maxconn reached"
            - "emergency stop"
    condition: selection_http2 or selection_crash or selection_restart
    timeframe: 60s
level: high
falsepositives:
    - Legitimate clients with broken HTTP/2 implementations sending malformed frames
    - Normal HAProxy restarts during configuration reloads
fields:
    - src_ip
    - dst_port
    - http_version
    - msg

YARA Rule

rule HAProxy_CVE_2026_26080_Varint_Exploit_Payload
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects network traffic containing malformed varint sequences targeting HAProxy CVE-2026-26080"
        cve = "CVE-2026-26080"
        date = "2026-06-15"
        severity = "medium"
    strings:
        // HTTP/2 connection preface followed by malformed HEADERS frame
        $http2_preface = { 50 52 49 20 2A 20 48 54 54 50 2F 32 2E 30 0D 0A 0D 0A 53 4D 0D 0A 0D 0A }  // "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"
        $headers_frame_type = { 01 }
        $flags_end_headers = { 04 }
        $continuation_bytes = { (FF FF FF FF [0-9]) }
        $varint_overflow = { (FF){4,16} }
        // QUIC Initial packet with overlong varint packet number
        $quic_long_header = { C3 }
        $quic_varint_5byte = { 1F (FF){4} }
        $quic_varint_8byte = { 3F (FF){7} }
    condition:
        (uint16(0) == 0x0D0A and #http2_preface > 0 and $headers_frame_type at 9 and $flags_end_headers at 9 and #continuation_bytes >= 4)
        or
        ($http2_preface and $varint_overflow)
        or
        ($quic_long_header and ($quic_varint_5byte or $quic_varint_8byte))
}

Suricata IDS Rule

alert http2 any any -> any any (msg:"ET EXPLOIT HAProxy CVE-2026-26080 Varint Parsing DoS Attempt"; flow:established,to_server; http2.header_names; content:"|ff ff ff ff|"; http2.header_names; offset:0; depth:64; within:64; reference:cve,2026-26080; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-26080; classtype:attempted-dos; sid:2026260801; rev:1;)

alert udp any any -> any 443 (msg:"ET EXPLOIT HAProxy QUIC Varint Overflow DoS Attempt CVE-2026-26080"; flow:to_server; content:"|ff ff ff ff|"; depth:40; within:40; reference:cve,2026-26080; classtype:attempted-dos; sid:2026260802; rev:1;)

alert tcp any any -> any any (msg:"ET EXPLOIT HAProxy Overlong Varint Stream Detection CVE-2026-26080"; flow:established,to_server; content:"|c3 33 44 55 ff ff ff ff ff ff ff ff|"; depth:80; within:80; reference:cve,2026-26080; classtype:attempted-dos; sid:2026260803; rev:1;)

Elastic Detection

// Detect repeated HAProxy worker crashes within a short window
sequence by host.name with maxspan=5m
  [ any where process.name : "*haproxy*" and event.type : "end" and shellcode or process.exit_code : (11, 6) ]
  [ any where process.name : "*haproxy*" and event.type : "start" ]
  [ any where process.name : "*haproxy*" and event.type : "end" ]

// Detect malformed HTTP/2 requests logged by HAProxy
any where event.category : "web" and http.response.status_code : 400 and
  url.original : "*" and http.version : "2" and
  http.request.body.bytes : * and
  // Look for HPACK decoder errors in log message
  message : "*varint*" or message : "*malformed*" or message : "*decoder error*"

// Network-level detection: Suricata/Kibana alerts matching CVE-2026-26080
any where event.module : "suricata" and suricata.eve.alert.signature_id : (2026260801, 2026260802, 2026260803)

Splunk SPL Query

index="haproxy" sourcetype="haproxy:logs"
| spath input=message path=msg
| search (event_type="badreq" AND http_version="2.0" AND (msg="*varint*" OR msg="*malformed header*" OR msg="*unsupported version*"))
   OR (event_type="haproxy_master" AND (msg="*watchdog timeout*" OR msg="*signal 11*" OR msg="*signal 6*" OR msg="*segfault*"))
   OR (msg="*worker process exited*")
| eval crash_count=case(event_type=="haproxy_master" AND msg LIKE "%signal%",1,1=1,0)
| stats count as event_count, sum(crash_count) as crash_total by host, src_ip, _time
| rename host as haproxy_host, src_ip as source_address
| where crash_total > 2 OR event_count > 10
| table _time, haproxy_host, source_address, event_count, crash_total
| sort - _time

Wazuh OSSEC Rule

<group name="haproxy,">
  <!-- Detect malformed HTTP/2 traffic indicating CVE-2026-26080 exploitation -->
  <rule id="935398" level="10">
    <decoded_as>haproxy</decoded_as>
    <field name="event_type">badreq</field>
    <field name="http_version">2.0</field>
    <regex>varint|malformed|decoder error|out of range</regex>
    <description>HAProxy CVE-2026-26080: Malformed HTTP/2 varint sequence detected, possible DoS attempt</description>
    <group>haproxy,denial_of_service,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <!-- Detect repeated HAProxy crashes indicative of ongoing exploitation -->
  <rule id="935399" level="12" frequency="3" timeframe="300">
    <decoded_as>system</decoded_as>
    <regex>haproxy.*(signal 11|signal 6|segmentation fault|watchdog timeout)</regex>
    <description>HAProxy process crashing repeatedly, potential CVE-2026-26080 exploitation</description>
    <group>haproxy,denial_of_service,</group>
    <mitre>
      <id>T1498</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1. Immediate Mitigations (hours):

   • Upgrade to HAProxy Community Edition 3.3.3 or higher immediately. This is the only confirmed patched version. Debian has packaged this fix; check for haproxy package version 3.3.3 or later in your distribution's repositories.
   • If immediate upgrade is not feasible, disable HTTP/2 support on frontends by removing alpn h2 from bind directives or setting bind :443 ssl crt /path/to/cert alpn http/1.1. This eliminates the primary attack vector for HTTP/2-based exploitation.
   • For Enterprise/ALOHA deployments, contact HAProxy support for the patched build. Until vendor confirmation arrives, treat these distributions as vulnerable and apply the same workarounds.
   • Restrict network access to HAProxy management/statistics ports (8404) using firewalls—these are not direct attack vectors but reduce reconnaissance capability.

2. Patch/Upgrade Steps:

   • Debian/Ubuntu: Deploy the patched package haproxy 3.3.3 from the security repository.

     apt-get update
     apt-cache policy haproxy  # verify 3.3.3 is available
     apt-get install --only-upgrade haproxy
     systemctl restart haproxy
     

   • Red Hat/CentOS: HAProxy is not typically in base repos; use official HAProxy repositories or build from source:

     wget https://www.haproxy.org/download/3.3/src/haproxy-3.3.3.tar.gz
     tar -xzf haproxy-3.3.3.tar.gz
     cd haproxy-3.3.3
     make -j$(nproc) TARGET=linux-glibc
     make install PREFIX=/usr/local
     systemctl restart haproxy
     

   • Docker/Container: Update your HAProxy image tag from haproxy:3.3.2 to haproxy:3.3.3 (or later). Rebuild and redeploy.
   • After patching, verify the fix by sending a malformed varint sequence to a staging instance and confirming the process handles it gracefully (logs an error rather than crashing).

3. Long-Term Hardening:

   • Configuration: Set hard-stop-after 30s in the global section to automatically terminate stuck worker processes, though this is a mitigation for infinite loops—verify it works with your HAProxy version.
   • Resource Limits: Configure ulimit-n and maxconn appropriately to prevent resource exhaustion cascades if a worker enters a corrupted state.
   • Monitoring: Implement proactive HAProxy health checks using keepalived or systemd auto-restart (Restart=on-failure) to minimize downtime if the vulnerability is triggered before patching.
   • Network Segmentation: Place HAProxy behind a WAF or layer-7 firewall that can filter malformed HTTP/2 frames at edge.
   • Version Management: Subscribe to HAProxy security advisories (https://www.haproxy.org/security/) and apply patches within 48-72 hours of release. Track the CVE-2026-26080 advisory for patch confirmation from HAProxy Enterprise/ALOHA.
   • Architecture: Consider deploying HAProxy with multiple workers (nbproc or nbthread) so a single worker crash doesn't cause full service outage, and use reload configurations to minimize downtime during patching.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-26080
2. HAProxy Official Security Page: https://www.haproxy.org/security/ (monitor for official advisory and patch confirmation for Community Edition 3.3.3)
3. HAProxy Enterprise/ALOHA Security: https://www.haproxy.com/support/security-advisories/ (check for vendor patch status, given 2/4 confidence)
4. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-26080 (Debian confirmation of patch availability)
5. CWE-252 Unchecked Return Value Reference: https://cwe.mitre.org/data/definitions/252.html (underlying weakness class)

Threat Actor Activity: As of this report's publication date (June 15, 2026), there is no known exploitation in the wild. CVE-2026-26080 is NOT listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00416 (34.2 percentile) indicates the vulnerability is not currently being actively exploited. However, given that HAProxy is a critical piece of internet infrastructure, and the Debian patch confirms the flaw, exploitation attempts may emerge once proof-of-concept code becomes publicly available. SOC teams should treat this as a high-priority patch due to the criticality of HAProxy in service delivery, despite the low technical severity score. No known threat actor campaigns have been attributed to this CVE as of the analysis date.