The vulnerability in HAProxy Community Edition 3.0 through 3.3 before 3.3.3 involves a lack of length validation for the NEW_TOKEN format, which can lead to improper handling of input data. This flaw is present also in HAProxy Enterprise and ALOHA products. The CVSS 3.1 base score vector indicates a network attack vector with high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. There are no known exploits in the wild and no patch links provided in the data.

The vulnerability could allow an attacker to cause low integrity and low availability impacts on affected HAProxy versions by exploiting the lack of length checks on the NEW_TOKEN format. However, no confidentiality impact is expected. The attack complexity is high, and no privileges or user interaction are required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor vendor communications for updates. No cloud service remediation applies as this is not a cloud service.