Is HAProxy 2.7.12 affected?

CVSS 8.2

2 known vulnerabilities affect 2.7.12 (highest CVSS 8.2).

Your branch 2.7 has reached end of life (Apr 5, 2024).

21 newer releases in its track, up to 3.4.7. What changed up to 3.4.7

Vulnerabilities affecting 2.7.12

8.2
CVE-2023-45539 HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a path_end… fixed in 2.8.2
4.0
CVE-2026-33555 An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame w… fixed in 3.3.6