HAProxy is not vulnerable to HTTP2Shell (CVE-2026-111497)
HAProxy is not vulnerable to Brotli CVEs (HTTP2Shell) because it doesn't provide Brotli decoding. However, it can help protect vulnerable backends by blocking potentially dangerous requests.
Articles in category
CVE
October 2026 - CVE Security Bulletin
The latest versions of HAProxy Fusion, ALOHA, Data Plane API, & HAProxy CE/EE fix 5 vulnerabilities. 3 are critical & should be patched first. If you run an affected version, update to a fixed build.
HAProxy Enterprise WAF protects against PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Protect your infrastructure from PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) using HAProxy Enterprise WAF. Learn about immediate mitigation strategies and WAF protection.
June 2026 – CVE-2026-55204: null pointer dereference in HAProxy's HPACK header handling
HAProxy advisory for CVE-2026-55204: a null pointer dereference in HPACK header handling. While rated 8.7 (High), the real-world risk is low. Details on impact and remediation are provided.
Protecting against HTTP/2 Bomb vulnerability (CVE-2026-49975) with HAProxy
Protect your infrastructure from the HTTP/2 Bomb vulnerability (CVE-2026-49975) using HAProxy. Learn about immediate mitigation strategies and automatic protection.
HAProxy Enterprise WAF protects against Drupal core SA-CORE-2026-004 SQL Injection (CVE-2026-9082)
Protect your infrastructure from Drupal SQL Injection (CVE-2026-9082) using HAProxy Enterprise WAF. Learn about immediate mitigation strategies and automatic WAF protection.
February 2026 — CVE-2026-26080 and CVE-2026-26081: QUIC denial of service
HAProxy patch for two high-severity QUIC vulnerabilities (CVE-2026-26080, CVE-2026-26081) that allow a remote denial of service attack. Upgrade now for protection or disable the QUIC component.
HAProxy Enterprise WAF Protects Against React2Shell (CVE-2025-55182)
Protect your infrastructure from React2Shell (CVE-2025-55182) using HAProxy. Learn about immediate mitigation strategies and automatic WAF protection.
October 2025 – CVE-2025-59303: secret leak in HAProxy Kubernetes Ingress Controller
Upgrade to the lastest version of HAProxy Kubernetes Ingress Controller (KIC) to address a vulnerability allowing privilege escalation. Learn about affected versions, remediation, and workarounds.
October 2025 – CVE-2025-11230: denial of service vulnerability in HAProxy mjson library
The latest versions of HAProxy Community and Enterprise have patches for a critical denial of service vulnerability in the mjson library.
HAProxy Enterprise WAF protects against Microsoft SharePoint CVE-2025-53770 / CVE-2025-53771
CVE-2025-53770 and CVE-2025-53771 are currently being exploited in the wild. However, users of HAProxy Enterprise WAF are protected automatically.
Protecting against SAP NetWeaver vulnerability (CVE-2025-31324) with HAProxy
Mitigate SAP NetWeaver CVE-2025-31324 with HAProxy. Learn how to block unauthenticated file uploads and protect your systems from severe risk.
January 2025 – Multiple rsync CVEs impacting memory and file handling in Linux virtual images
The latest versions of HAProxy Fusion fix multiple rsync vulnerabilities related to memory handling and file management in HAProxy Fusion’s Linux-based virtual images. We will cover these CVEs here.