HAProxy 3.2 QUIC Frame Parsing Vulnerability (CVE-2026-26080) Causing DoS

Vulnerability Overview Project Name: haproxy-3.2.git Author: Amaury Denoyelle Commit Date: September 9, 2026 Description: The QUIC frame type is encoded as a variable-length integer. Initially, HAProxy parsed it as a single byte, which was sufficient for the frames defined in RFC 9000. However, the code was recently extended to support multi-byte encoded values to accommodate QUIC frame extensions. The variable-length integer format was not validated, causing it to be interpreted as an invalid value representing a PADDING frame. Consequently, the remainder of the packet was processed incorrectly, leading to various outcomes, including infinite loops and/or crashes. Fix: This patch resolves the issue by checking the return value of . If the variable-length integer cannot be parsed, the connection is immediately closed. CVE Number: CVE-2026-26080 Reporter: Asin Yildiz Oglu Manizada Impact Scope Affected Versions: HAProxy 3.2 Potential Impact: Infinite loops and/or crashes Fix Details Specific Fix: Check the return value of ; if the variable-length integer cannot be parsed, immediately close the connection. POC Code or Exploit Code No POC code or exploit code available Additional Information Commit Hash: 5b6098c0b4a56ec57114a634c4e87712b1261e7a1 Tree Hash: a15d6c7b17b6ae76d813b47217b5a9966b252 Parent Commit Hash: 4765277f4915baac2657003538ffba59966beb File Path: src/quic_frame.c Summary This vulnerability involves an error in HAProxy's handling of QUIC frame types, which can lead to infinite loops and/or crashes. The fix ensures proper parsing of the variable-length integer by checking the return value of and immediately closing the connection if parsing fails.

Goal Reached Thanks to every supporter — we hit 100%!

HAProxy 3.2 QUIC Frame Parsing Vulnerability (CVE-2026-26080) Causing DoS