This bulletin covers five CVEs affecting HAProxy products. Several are critical across Data Plane API and HAProxy Fusion as they can grant an attacker administrative access to your instances, depending on how your control plane is deployed and whether it is accessible on the public Internet. Two are denial-of-service bugs in HAProxy’s HTTP/1 and HTTP/2 handling that can tie up worker threads. The latest release of each product covers all the latest security fixes.
For HAProxy Fusion
Customers on version 2.x should immediately update to 2.0.23
Customers on version 1.3.x should immediately update to 1.3.45-553.0
If you run Data Plane API (CE or EE) with mutual TLS alongside an HTTP or UNIX socket listener, you should update now or disable the listeners as a workaround.
All other HAProxy products: Update HAProxy Enterprise, ALOHA, HAProxy Kubernetes Ingress Controller, HAProxy Unified Gateway, and Community Edition at the next reasonable opportunity.
See the table below for more information about affected and fixed versions for each product.
If you use image or marketplace versions of HAProxy, ensure you’re using the latest available version as of the publication date of this security bulletin.
CVE | What it affects | Severity | Fixed in | Details |
Fusion user API (roles) | 9.9 Critical | Fusion 2.0.23 Fusion 1.3.45-553.0 | ||
Fusion ADFS/OIDC login | 9.0 Critical | |||
Data Plane API authentication | 9.8 Critical | 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29 | ||
HAProxy HTTP/1 chunk parser | 7.5 High | See below for HAProxy CE, HAProxy EE, HAProxy ALOHA, KIC, and HUG versions | ||
HAProxy HTTP/2 PING handling | 7.5 High |
1. CVE-2026-110351 and CVE-2026-110352: HAProxy Fusion privilege escalation and login token bypass
Severity: 9.9 Critical / 9.0 Critical (CVSS v3.1) · CWE-863 Incorrect Authorization, CWE-1023 Incomplete Comparison with Missing Factors
CVE-2026-110351 (role escalation): The user update API (PUT /controller/users/{id}) never checked role changes. Any user allowed to edit their own profile, such as one with the built-in read-only-plus-profile role, could give themselves the admin role and take control of Fusion and its managed nodes.
CVE-2026-110352 (login token claims): With ADFS/OIDC login using oic_indirect tokens, Fusion checked the token signature but not its expiry, start time or audience. An attacker holding a victim's token, even an expired one or one issued for another app, can sign in as that user.
Fixed in:
Product | Affected versions | Fixed version |
HAProxy Fusion | 2.x before 2.0.23 1.3.x | 2.0.23 1.3.45-553.0 |
Recommended action: Update to 2.0.23, then check user roles for unexpected admin grants. Until you can update, remove roles with change_own_profile from users who don't need them, and switch off ADFS/OIDC login if you use oic_indirect tokens.
More detail: CVE-2026-110351 record · CVE-2026-110352 record
Our assessment
The scores reflect the practical risk. CVE-2026-110351 needs only a low-privileged account and one API request to reach full control. CVE-2026-110352 is harder to exploit, since the attacker must first obtain a token, and applies only to ADFS/OIDC setups, but the impact is the same. Treat this update as urgent. The Fusion Control Plane is only vulnerable depending on how access to it is handled on your network (e.g., behind your firewall).
2. CVE-2026-109575: Data Plane API authentication bypass with mutual TLS
Severity: 9.8 Critical (CVSS v3.1) · CWE-306 Missing Authentication for Critical Function · Reported by Yonghwa Lee
When mutual TLS is configured (tls_ca and tls_port), the Data Plane API turns off Basic authentication for all of its listeners, but checks client certificates only on HTTPS. Any HTTP or UNIX socket listener running at the same time accepts requests with no credentials, letting an attacker read or replace the HAProxy configuration.
Affects: Data Plane API 2.2.0 through 3.4.3 and the matching Enterprise releases, when mutual TLS runs alongside an HTTP or UNIX socket listener.
Fixed in:
Product | Affected versions | Fixed version |
Data Plane API Community Edition | 2.2.0–2.9.28, 3.0.0–3.0.24, 3.1.0–3.2.16, 3.3.0–3.3.8, 3.4.0–3.4.3 | 2.9.29, 3.0.25, 3.2.17, 3.3.9, 3.4.4 |
Data Plane API Enterprise Edition | 2.2.0-ee1–2.9.28-ee1, 3.0-ee–3.0.24-ee1, 3.1-ee–3.2.16-ee1, 3.3-ee–3.3.8-ee1, 3.4-ee–3.4.3-ee1 | 2.9.29-ee1, 3.0.25-ee1, 3.2.17-ee1, 3.3.9-ee1, 3.4.4-ee1 |
Recommended action: Update to a fixed version. Until you can, turn off the HTTP and UNIX socket listeners, or block access to them.
More detail: Fix commit · Release notes · CVE record
Our assessment
The 9.8 score assumes the vulnerable configuration. You are exposed only if mutual TLS and an HTTP or UNIX socket listener are enabled together; HTTPS-only setups are safe. Where both conditions hold, the score is accurate: no credentials are needed, and the attacker can rewrite the load balancer configuration.
3. CVE-2026-110354 and CVE-2026-110353: HAProxy CPU exhaustion from malformed HTTP/1 and HTTP/2 requests
Severity: 7.5 High (CVSS v3.1) · CWE-835 Infinite Loop, CWE-252 Unchecked Return Value · Reported by Adam Crawford (CVE-2026-110354); found internally (CVE-2026-110353)
CVE-2026-110354 (HTTP/1 chunk-size line): A chunked request traps the parser in a loop. The thread stays at 100% CPU after the client leaves, and repeated requests can stall every thread until HAProxy restarts.
CVE-2026-110353 (HTTP/2 PING frame): A truncated PING frame is never consumed, so the HTTP/2 multiplexer spins until timeout http-request closes the connection. Many such connections keep CPU usage high.
Fixed in:
Product | Affected versions | Fixed version |
HAProxy Community Edition | 2.6, 2.8, 3.0, 3.2, 3.3, 3.4 | 2.6 and later, see haproxy.org |
HAProxy Enterprise | 2.6r1, 2.8r1, 3.0r1, 3.2r1, 3.3r1 | 2.6r1-308.1996, 2.8r1-343.1659, 3.0r1-362.1441, 3.2r1-378.1259, 3.3r1-377.1005 |
HAProxy ALOHA | 14.5, 15.5, 16.5, 17.5, 18.0 | 14.5.0–14.5.52, 15.5.0–15.5.51, 16.5.0–16.5.45, 17.5.0–17.5.35, 18.0.0–18.0.14 |
HAProxy Community Edition Kubernetes Ingress Controller | v3.2 | v3.2.17 |
HAProxy Enterprise Kubernetes Ingress Controller | v3.2, v3.0, v1.11 | v3.2.17-ee1, v3.0.16-ee17, v1.11.14-ee11 |
HAProxy Unified Gateway for Kubernetes | v1.0 | v1.0.8 |
Recommended action: Update to the fixed build for your branch. For CVE-2026-110353, you can turn off HTTP/2 on exposed frontends or lower timeout http-request in the meantime. CVE-2026-110354 has no known workaround; restarting HAProxy frees a stuck thread.
More detail: HTTP/1 fix commit · HTTP/2 fix commit · CVE-2026-110354 record · CVE-2026-110353 record
Our assessment
Both issues affect availability only; neither exposes data. CVE-2026-110354 is more serious, since a few requests can stall the whole process until restart. CVE-2026-110353 is bound by timeout http-request. The 7.5 High score fits. Update at your next maintenance window, more urgent for internet-facing instances.
How to update
Users of affected products should update by pulling the latest image or package for their release track.
HAProxy Enterprise: see the upgrade instructions in the customer documentation.
HAProxy Enterprise with HAProxy Fusion: upgrade your nodes from the Fusion control plane.
HAProxy Fusion: update the control plane to 2.0.23.
HAProxy ALOHA: follow the standard firmware update procedure.
HAProxy Data Plane API: install the fixed Enterprise package, or download the Community Edition release from GitHub.
HAProxy Community Edition: update to the fixed tagged release, or compile from the latest source.
HAProxy Enterprise Kubernetes Ingress Controller: update to the fixed tagged release.
HAProxy Community Edition Kubernetes Ingress Controller: update to the fixed tagged release.
HAProxy Unified Gateway for Kubernetes: update to the fixed tagged release.
Support
If you are an existing HAProxy customer with questions about these advisories or upgrade procedures, please consult our customer documentation or contact support.
Subscribe to our blog. Get the latest release updates, tutorials, and deep-dives from HAProxy experts.
