HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. (CVE-2026-26081)

The vulnerability in HAProxy Community Edition versions 3.0 through 3.3 prior to 3.3.3 arises from the absence of a length check for the NEW_TOKEN format. This defect can lead to potential issues related to improper handling of token lengths. The affected versions include 3.0, all versions from 3.0.0 up to but not including 3.0.16, 3.1.0 up to but not including 3.1.14, 3.2.0 up to but not including 3.2.12, and 3.3.0 up to but not including 3.3.3. Both HAProxy Enterprise and ALOHA editions are also impacted. A patch is available to address this vulnerability.

The vulnerability could allow improper processing of token lengths, which may lead to unexpected behavior or potential security issues in HAProxy deployments using affected versions. The specific impact details are not provided, but the medium severity rating suggests a moderate risk.

A patch is available for this vulnerability. Users should upgrade to HAProxy version 3.3.3 or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.