Is HAProxy 2.6.35 affected?

CVSS 8.2

2 known vulnerabilities affect 2.6.35 (highest CVSS 8.2).

22 newer releases in its track, up to 3.4.7. What changed up to 3.4.7

Vulnerabilities affecting 2.6.35

8.2
CVE-2023-45539 HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end… fixed in 2.8.2
4.0
CVE-2026-33555 An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame w… fixed in 3.3.6