This advisory covers a security update to the haproxy RPM packages included in Red Hat Hardened Images. The update to haproxy-3.0.25-0.1.1.hum1 addresses vulnerabilities tracked under CVE-2026-26080 and CVE-2026-26081. The vulnerabilities relate to issues categorized under CWE-252 (Unchecked Return Value), CWE-835 (Loop with Unreachable Exit Condition), and CWE-120 (Buffer Copy without Checking Size of Input). The affected versions include haproxy versions 3.0 and versions from 3.2.0 up to but not including 3.3.3. Red Hat provides this update for aarch64 and x86_64 architectures. No active exploitation is known, and the update is available to mitigate these issues.

The vulnerabilities could potentially allow improper handling of certain conditions or buffer operations within haproxy, which may lead to unexpected behavior or security weaknesses. However, no known exploits are reported in the wild, and the overall severity is assessed as medium by Red Hat and low by the GCVE database. The impact is limited to the affected haproxy versions within Red Hat Hardened Images on specified architectures.

A patch is available and should be applied to affected systems. Red Hat has released haproxy version 3.0.25-0.1.1.hum1 for aarch64 and x86_64 architectures as part of the Hardened Images RPM update. Users should follow Red Hat's official update procedures as detailed in the advisory at https://images.redhat.com/. No additional mitigation steps are indicated by the vendor advisory.