Veille CVE

Semaine du 20 juillet au 26 juillet 2026

3 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Haproxy haproxy » ✕
  1. CVE-2026-55851 7.5 Élevée

    netty · Netty netty

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

  2. CVE-2026-26081 4.8 Moyenne

    HAProxy · Haproxy haproxy · Haproxy aloha · Haproxy haproxy enterprise

    HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.

  3. CVE-2026-26080 3.7 Faible

    HAProxy · Haproxy haproxy · Haproxy aloha · Haproxy haproxy enterprise

    HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.