The vulnerability identified as CVE-2026-26080 affects HAProxy Community Edition versions from 3.2.0 up to but not including 3.3.3. The issue arises from improper handling of variable-length integers (varint), which can cause the application to enter an infinite loop or crash. This behavior leads to a denial of service condition. The vulnerability is classified under CWE-252, indicating an unchecked return value that may lead to unexpected behavior. No known exploits are reported in the wild. The CVSS v3.1 vector indicates a network attack vector with high attack complexity, no privileges required, no user interaction, and impacts only availability with low severity.

Successful exploitation of this vulnerability can cause HAProxy to crash or enter an infinite loop, resulting in denial of service. There is no impact on confidentiality or integrity. The severity is low due to the high attack complexity and limited impact scope.

No official patch links are provided in the data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor for updates from HAProxy and consider mitigating exposure by limiting access to HAProxy management interfaces or applying any recommended workarounds from the vendor.