HAProxy
Network · products/haproxy.yaml · RSS
Latest 3.4.7 Oct 14, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 3.4 LTS | 3.4.7 | Jun 3, 2026 | Apr 1, 2031 · maintained |
| 3.3 | 3.3.17 | Nov 26, 2025 | Jan 1, 2027 · maintained |
| 3.2 LTS | 3.2.26 | May 28, 2025 | Apr 1, 2030 · maintained |
| 3.1 | 3.1.17 | Nov 26, 2024 | Jan 1, 2026 · ended |
| 3.0 LTS | 3.0.30 | May 29, 2024 | Apr 1, 2029 · maintained |
| 2.9 | 2.9.15 | Dec 5, 2023 | Mar 21, 2025 · ended |
| 2.8 LTS | 2.8.31 | May 31, 2023 | Apr 1, 2028 · maintained |
| 2.7 | 2.7.12 | Dec 1, 2022 | Apr 5, 2024 · ended |
| 2.6 LTS | 2.6.35 | May 31, 2022 | Apr 1, 2027 · maintained |
| 2.5 | 2.5.14 | Nov 23, 2021 | May 2, 2023 · ended |
| 2.4 LTS | 2.4.36 | May 14, 2021 | Apr 1, 2026 · ended |
| 2.3 | 2.3.21 | Nov 5, 2020 | Jul 27, 2022 · ended |
| 2.2 LTS | 2.2.34 | Jul 7, 2020 | Apr 23, 2025 · ended |
| 2.1 | 2.1.12 | Nov 25, 2019 | Mar 18, 2021 · ended |
| 2.0 | 2.0.35 | Jun 16, 2019 | Apr 5, 2024 · ended |
| 1.9 | 1.9.16 | Dec 19, 2018 | Jul 31, 2020 · ended |
| 1.8 | 1.8.31 | Nov 26, 2017 | Dec 9, 2022 · ended |
| 1.7 | 1.7.14 | Nov 25, 2016 | Oct 1, 2021 · ended |
| 1.6 | 1.6.16 | Oct 13, 2015 | Oct 1, 2020 · ended |
| 1.5 | 1.5.19 | Jun 19, 2014 | Jan 10, 2020 · ended |
| 1.4 | 1.4.27 | Feb 26, 2010 | Jan 10, 2020 · ended |
| 1.3 | 1.3.28 | Jun 29, 2006 | Mar 14, 2016 · ended |
| 1.2 | 1.2.18 | Nov 9, 2003 | Aug 6, 2011 · ended |
| 1.1 | 1.1.34 | Mar 10, 2002 | Jan 29, 2006 · ended |
| 1.0 | 1.0.2 | Dec 16, 2001 | Dec 30, 2001 · ended |
Recent releases
Security advisories
3.7 CVE-2026-26080 HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected.
4.8 CVE-2026-26081 HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected.
7.5 CVE-2026-55203 HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers. When conten…
7.5 CVE-2026-55204 HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_…
4.0 CVE-2026-33555 An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame w…
7.5 CVE-2025-11230 Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.
7.5 CVE-2024-45506 HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service for HTTP/2 zero-copy forwarding (h2_send loop) under a certain set of conditions, as ex…
8.2 CVE-2023-45539 HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end…
7.2 CVE-2023-40225 HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2.8.2 forwards empty Content-Length head…
7.3 CVE-2023-25950 HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensit…
7.5 CVE-2023-0836 An information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.6.8, 2.7 before 2.7.1. There are 5 bytes left uninitializ…
6.5 CVE-2023-0056 An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malici…
9.1 CVE-2023-25725 HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept em…
7.5 CVE-2022-0711 A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite l…
7.5 CVE-2021-40346 An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request…
7.5 CVE-2021-39240 An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It does not ensure that the scheme and path portions of a URI have the expected characters. For exampl…
5.3 CVE-2021-39241 An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. An HTTP method name may contain a space followed by the name of a protected resourc…
7.5 CVE-2021-39242 An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3. It can lead to a situation with an attacker-controlled HTTP Host header, because a mismatch between Ho…
8.8 CVE-2020-11100 In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP…
9.8 CVE-2019-19330 The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd), line feed (LF, ASCII 0xa), and the zero character (NUL, ASCII 0x0), aka In…