HAProxy Community Edition versions 3.0 through 3.3 before 3.3.3 have a vulnerability due to the lack of a length check for the NEW_TOKEN format. This issue also affects HAProxy Enterprise and ALOHA editions. The vulnerability is identified as CWE-130 and is classified with medium severity.