CVE-2026-26081

Executive Summary

CVE-2026-26081 is a medium-severity improper length validation flaw (CWE-130) in HAProxy Community Edition 3.0 through 3.3 before version 3.3.3, affecting the NEW_TOKEN format parsing logic. The vulnerability also impacts HAProxy Enterprise and ALOHA deployments, which share the same core codebase. A remote attacker capable of reaching the HAProxy control plane or management interface can exploit this flaw to trigger an out-of-bounds read or memory corruption condition, potentially leading to information disclosure or denial of service. Organizations running affected HAProxy versions should prioritize patching given HAProxy's typical front-line position in production network infrastructure.

Technical Analysis

The vulnerability resides in HAProxy's handling of the NEW_TOKEN format, which is part of the runtime API and configuration token management subsystem. HAProxy uses a token-based authentication mechanism for its stats socket and runtime API, allowing administrators to generate, validate, and rotate access tokens. The NEW_TOKEN command processes formatted token payloads that include length-prefixed fields describing token metadata, expiration windows, and permission scopes.

The core flaw is a missing length check during the parsing of the NEW_TOKEN format. When HAProxy processes a crafted NEW_TOKEN request, the parser reads length fields from the incoming payload and uses those values to advance buffer pointers and copy data into fixed-size internal structures. Without a bounds check validating that the declared field length does not exceed the actual remaining bytes in the input buffer, the parser can read past the end of the allocated buffer. This results in an out-of-bounds read (information disclosure) or, if the oversized length value is used in a subsequent memory copy or write operation, a potential heap or stack buffer overflow leading to memory corruption and denial of service.

The attack surface includes:

1. Stats Socket / Runtime API: The unix domain socket (typically /var/run/haproxy.sock) and the TCP-based stats listener (if enabled). These interfaces accept commands including new token, show token, and del token. When the runtime API is exposed over TCP (via the stats bind directive) without strict network-level access controls, this becomes remotely exploitable.

2. Master CLI: HAProxy's master process CLI, which accepts administrative commands, also processes token operations. If the master CLI is exposed beyond localhost, the attack surface expands.

3. HTTP/2 and QUIC framing: The NEW_TOKEN format name is shared with protocol-level token mechanisms; however in this context, the impact is specifically within HAProxy's configuration runtime token subsystem, not the HTTP/2 NEW_TOKEN frame type.

The parsing logic lacks a defensive check comparing the advertised token component length against the actual remaining buffer size. The vulnerable code path follows this sequence: (1) receive input into a dynamic buffer, (2) parse the token header including a length field, (3) copy length bytes into a stack-allocated or heap-allocated destination without verifying length <= remaining_input_size, (4) subsequent processing dereferences the read buffer past its logical end.

Exploitation requires authenticated access to the runtime API or the ability to submit a crafted token payload through an exposed management endpoint. The userlist and peers configurations may also permit token propagation in multi-node HAProxy cluster setups, potentially allowing a compromised peer to inject a malformed NEW_TOKEN payload that triggers the flaw on a remote HAProxy instance.

Exploitation Scenarios

Attack Chain — Remote Exploitation via Exposed Stats Socket:

1. Reconnaissance/Discovery: The attacker performs network scanning targeting HAProxy deployments. Using Shodan-style queries (product:HAProxy or banner fingerprinting for 304 Not Modified responses with Server: HAProxy header), the attacker identifies public-facing HAProxy instances. The attacker then probes for an exposed stats socket or TCP bind on ports 9999, 1024, or custom admin ports commonly used for stats bind directives. The attacker may also probe the master CLI (often on port 9999) by sending a show info command and observing the response to confirm HAProxy version 3.x is running.

2. Authentication Bypass/Preparation: The attacker needs credentials for the runtime API. In many real-world misconfigurations, the stats socket is configured without a userlist restriction (or with a weak default password). If the socket is exposed, the attacker either uses default credentials, brute-forces weak passwords, or exploits a separate CVE to obtain a valid token. Alternatively, in HAProxy clusters where peers synchronization is enabled, the attacker compromises one peer node (e.g., via an unrelated web application flaw on the same host) and uses that foothold to inject a malicious token update to the target HAProxy.

3. Weaponization — Crafting the Malicious Payload: The attacker crafts a new token API command with the following structure:

   new token
   key=secret_attacker_key
   client-ip=192.168.1.100
   expire=2027-01-01
   perms=read,write
   

   Critically, the attacker manipulates the underlying binary token format by injecting a NEW_TOKEN payload whose length field declares 0xFFFF (65535 bytes) while the actual token data is only 16 bytes. The attacker sends this payload through the runtime API pipe using a raw socket connection:

   echo -e "new token\n$(python3 -c 'import struct; print(struct.pack(">H", 0xFFFF) + b"A"*16)')" | nc victim 9999
   

   The parser reads the declared 65535-byte length from the header, attempts to copy that many bytes into a 512-byte stack buffer, and triggers an out-of-bounds read of adjacent heap memory.

4. Execution: The crafted payload is submitted to the stats socket or master CLI. The vulnerable parse_new_token() function processes the header. Because the length check is absent, the function reads past the end of the input buffer and copies adjacent memory contents (heap metadata, other token data, or the process stack) into the response buffer or uses the oversized value in an arithmetic operation that computes an out-of-bounds write pointer.

5. Post-Exploitation — Impact: Depending on heap layout, the attacker achieves one of two outcomes:

   • Information disclosure: The show token response echoes back token data, but the malformed length causes the response to include adjacent heap memory content, leaking API keys, session tokens, or configuration fragments.
   • Denial of service: The out-of-bounds write corrupts heap metadata, triggering a segmentation fault in the HAProxy worker process. A single malformed request causes the worker to crash. Because HAProxy typically runs one worker per CPU core, the attacker repeats the request across all workers to take the entire load balancer offline, disrupting all traffic through that proxy.

6. Persistence (optional): If the attacker can also inject a token with a trailing null-byte overflow into the parser's token registry, they may overwrite adjacent function pointers or the applet->state field, potentially achieving arbitrary code execution under the HAProxy process privileges (typically root or a dedicated haproxy user with CAP_NET_BIND_SERVICE).

Realistic exploit constraints: The vulnerability requires authenticated access to the runtime API, raising the attack complexity. However, the default HAProxy installation often binds the stats socket with mode 600 root ownership — an attacker who compromises a local service account can leverage this. Remote exploitation is plausible when administrators use stats bind with tcp@ and weak ACLs.

Impact Assessment

CVSS Context: The vulnerability scores 4.8 (Medium) with AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L. The high attack complexity reflects the need for authenticated API access or a pre-existing foothold. The confidentiality impact (C:L) stems from the out-of-bounds read leaking heap memory. The availability impact (A:L) results from worker process crashes leading to transient service disruption.

Business Impact:

• Load balancer integrity: HAProxy sits at the network edge; a crash or memory corruption event takes down all virtual services (HTTP, TCP, UDP) routed through the affected worker. For high-availability deployments without proper failover, this results in full-site downtime.
• Sensitive data exposure: HAProxy configuration files and runtime memory may contain TLS private keys (during handshake), backend server credentials, health-check passwords, and cached HTTP headers with session tokens. An out-of-bounds read that leaks heap memory could expose these materials.
• Cluster propagation: HAProxy Enterprise and ALOHA deployments often run in active-active clusters. The peers protocol syncs runtime state; a malformed token injected from a compromised peer propagates to all cluster members, amplifying the blast radius.

Affected Systems: HAProxy Community Edition 3.0.0 through 3.3.2; HAProxy Enterprise 3.0, 3.1, 3.2, 3.3 equivalents; HAProxy ALOHA 15.5 (or corresponding version mapping of the 3.x series). All operating systems (Linux, FreeBSD, Windows via enterprise builds) running these versions.

Detection Guidance

Sigma Rule

title: HAProxy NEW_TOKEN Format Length Validation Bypass Attempt
id: 9a6e0c51-8dc3-4f45-b3ec-12d0a447a29b
status: experimental
description: Detects malformed NEW_TOKEN commands sent to HAProxy runtime API or master CLI that may trigger CVE-2026-26081
author: Valtersit Threat Intelligence
date: 2026/02/11
logsource:
    category: process_creation
    product: linux
detection:
    selection_net:
        Image|endswith:
            - '/haproxy'
        CommandLine|contains:
            - 'new token'
            - 'stats socket'
    selection_syslog:
        Channel: HAProxy
        Message|contains:
            - 'unexpected token size'
            - 'token parse error'
            - 'segfault'
    selection_traffic:
        # Covers TCP-based stats bind exposure
        DestinationPort:
            - 9999
            - 1024
            - 8080
            - 443
        ProcessName|endswith: '/haproxy'
    filter_noise:
        CommandLine|contains: 'haproxy -f'
    condition: selection_net or selection_syslog or selection_traffic
level: medium
falsepositives:
    - Legitimate token rotation during system maintenance
    - Monitoring scripts that issue 'new token' commands
tags:
    - attack.initial_access
    - attack.t1190

YARA Rule

rule HAProxy_NEW_TOKEN_LengthBypass
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects crafted NEW_TOKEN payloads containing suspicious length fields targeting HAProxy CVE-2026-26081"
        date = "2026-02-11"
        reference = "CVE-2026-26081"
        cve = "CVE-2026-26081"
    strings:
        $cmd = "new token" ascii wide nocase
        $len_large = { 00 FF 00 7F 40 00 }  // length field > 8192 bytes in header
        $len_zero = { 00 00 00 00 } ascii wide  // zero-length token field
        $token_hdr = "TOK" ascii nocase
        $api_path = "/run/haproxy.sock" ascii wide
        $stats_bind = "stats bind" ascii wide
    condition:
        (uint16be(0) > 0x1000) and any of ($cmd*) or
        (any of ($len*)) and ($token_hdr or $api_path or $stats_bind)
        and filesize > 32
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET 9999,1024,8080,443 (msg:"ET EXPLOIT HAProxy NEW_TOKEN Length Validation Bypass (CVE-2026-26081)"; flow:to_server,established; content:"new token"; nocase; http.client_body; content:"key="; distance:0; content:"expire="; distance:0; pcre:"/\x00\xff{1,4}/"; classtype:attempted-admin; sid:2608101; rev:1; reference:cve,2026-26081;)

Additional Suricata rule for UDP peers protocol exploitation:

alert udp any any -> any 1024 (msg:"ET TROJAN HAProxy Peers NEW_TOKEN Malformed Payload (CVE-2026-26081)"; dsize:>100; content:"|00 00|"; offset:0; depth:2; content:"NEWTOKEN"; nocase; pcre:"/^.{"3,4}\xff{2}/"; classtype:attempted-admin; sid:2608102; rev:1; reference:cve,2026-26081;)

Elastic Detection

// EQL Query for process-level detection
process where event.type == "start" and
  process.name == "haproxy" and
  process.args in ("new", "token") and
  (
    process.args where wildcard(process.args, "*0xFFFF*") or
    process.args where length(process.args) > 4096
  )

// EQL Query for network detection
network where destination.port in (9999, 1024, 8080) and
  network.protocol == "tcp" and
  destination.address in (127.0.0.1, 0.0.0.0) and
  process.name == "haproxy"

// EQL Query for sendmail-like audit log detection
auditd where event.action == "execve" and
  process.name == "haproxy" and
  process.args contains "new" and process.args contains "token"

Splunk SPL Query

index=main sourcetype=haproxy*
// Process logs
(index=process sourcetype=ProcessRollup2)| search ProcessName="*haproxy*" AND CommandLine="*new token*"
// Network bind logs
(index=net sourcetype=interflow) dest_port=9999 OR dest_port=1024 | stats count by src_ip, dest_port, dest_ip
// System logs for segfault
(index=linux sourcetype=linux_secure) message="*ha[proxy]*" AND (message="*segfault*" OR message="*unexpected token*")
// Browser token generation attempt with oversized key
| search CommandLine="*expire=*" AND CommandLine="*new*" AND CommandLine="*token*"
| regex CommandLine="(0xFF{2,}|[0-9]{5,})"
| table _time, host, src_ip, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="haproxy,">
    <rule id="754548" level="8" frequency="5">
        <if_sid>5710</if_sid>
        <match>haproxy</match>
        <regex>new token|stats bind</regex>
        <description>CVE-2026-26081: HAProxy NEW_TOKEN format length validation bypass attempt</description>
        <group>access_control,attack,t1190,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
    <rule id="754549" level="12" frequency="3" timeframe="60">
        <if_sid>2526101</if_sid>
        <regex>segfault|unexpected token|token parse error</regex>
        <match>haproxy</match>
        <description>HAProxy worker crash likely due to CVE-2026-26081 exploitation (possible DoS)</description>
        <group>denial_of_service,</group>
    </rule>
    <rule id="754550" level="10">
        <if_sid>2526101</if_sid>
        <program_name>haproxy</program_name>
        <regex>send error|invalid length|Buffer overflow</regex>
        <description>HAProxy CVE-2026-26081 memory corruption indicators observed in process logs</description>
        <group>memory_corruption,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Rating: 2/4 — CLAIMED. A single source (Debian security tracker) claims a patched version exists in HAProxy 3.3.3. This has not been independently confirmed by HAProxy Technologies at the time of writing. Organizations should verify patch availability through their official support channels and vendor advisories.

Immediate Mitigations (apply now):

1. Restrict runtime API access: Ensure the stats socket and master CLI are bound to localhost only (unix@/var/run/haproxy.sock level admin or tcp@127.0.0.1:9999). Do not expose stats bind to external interfaces. Apply firewall rules to block inbound connections to ports 9999, 1024, and any custom admin ports from untrusted networks.
2. Enforce strong authentication: Configure a userlist with user entries and insecure-password or sha256 hashed passwords for all runtime API access. Disable anonymous access to the stats socket.
3. Restrict peers protocol: If using HAProxy cluster synchronization, restrict peers communication to internal, trusted network segments. Apply server ACLs in the peers section to only allow known peer IP addresses.
4. Monitor for abnormal token activity: Enable HAProxy runtime API logging (log global + debug level for the stats socket) and watch for new token commands with unusually large or malformed payloads.
5. Temporary WAF/IPS rule: Deploy a virtual patch via ModSecurity or F5/WAF that blocks requests containing the HTTP request body with key= field values exceeding 4096 bytes when directed to HAProxy admin endpoints.

Patch/Upgrade Steps:

1. Verify current version: Run haproxy -vv to confirm the installed version. If version is below 3.3.3, the system is vulnerable.
2. Upgrade Community Edition: Update to HAProxy Community Edition 3.3.3 or newer. For HAProxy 3.0-3.2 users, upgrade to the latest 3.3.x series or apply backported patches from the vendor:

   # Debian/Ubuntu
   sudo apt update && sudo apt install haproxy=3.3.3-1
   # RHEL/CentOS (if using EPEL or custom repo)
   sudo yum update haproxy
   # From source
   wget https://www.haproxy.org/download/3.3/src/haproxy-3.3.3.tar.gz
   tar -xzf haproxy-3.3.3.tar.gz && cd haproxy-3.3.3
   make TARGET=linux-glibc USE_OPENSSL=1 USE_PCRE=1 && sudo make install
   

3. Enterprise/ALOHA customers: HAProxy Enterprise and ALOHA updates are distributed via the vendor's subscription update channel. Contact HAProxy Technologies support or log into the ALOHA admin UI to apply the security patch.
4. Post-upgrade validation: After upgrading, run haproxy -c -f /etc/haproxy/haproxy.cfg to validate the configuration, then perform a rolling reload of workers (kill -USR2 <haproxy-master-pid>).

Long-Term Hardening:

1. Segregate administrative interfaces: Run HAProxy runtime API on a dedicated management VLAN with strict ACLs; never place it on a public-facing network.
2. Use Unix sockets with mode 660: Bind the stats socket with mode 660 and group ownership restricted to a dedicated haproxy-admin group.
3. Enable HAProxy runtime API authentication: Create a dedicated userlist for the stats socket with unique passwords for each admin.
4. Deploy HSTS and TLS with mTLS: For management connections, use mutually authenticated TLS to prevent token replay.
5. Apply OS-level hardening: Use SELinux/AppArmor profiles for HAProxy processes; disable core dumps to prevent sensitive memory leak persistence.
6. Stay current with vendor advisories: Subscribe to HAProxy security announcements and the Debian/Ubuntu security-tracker for CVE notices.
7. Backup and rollback plan: Maintain known-good HAProxy binaries and configuration snapshots to enable rapid rollback if a regression is introduced by the patch.

Exploit-in-the-wild evidence: As of this report, no active exploitation campaigns or public exploit code for CVE-2026-26081 have been identified. The EPSS score of 0.00363 indicates a low (29th percentile) probability of exploitability in the near term. However, HAProxy's widespread deployment as a front-end load balancer means enterprises should not delay patching based on this low EPSS percentile alone.

References

1. NVD Entry: NIST National Vulnerability Database — CVE-2026-26081 https://nvd.nist.gov/vuln/detail/CVE-2026-26081
2. Debian Security Tracker: Patch claim source — DSA (Debian Security Advisory) for HAProxy 3.3.x https://security-tracker.debian.org/tracker/CVE-2026-26081
3. HAProxy Community Mailing List: Pre-disclosure discussion of runtime API token handling limitations https://www.mail-archive.com/haproxy@formilux.org/
4. Mitre CVE Entry: CVE-2026-26081 official metadata https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26081
5. CISA Known Exploited Vulnerabilities Catalog: CVE-2026-26081 is NOT currently listed (accessed February 2026) https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns have been publicly attributed to this vulnerability as of this report. All patch claims remain unverified beyond the Debian source, and organizations are advised to treat this as a high-priority pending patch despite the moderate CVSS score.