HAProxy 1.x — End of Life
EOL High riskHAProxy 1.x reached end of life on Jul 31, 2020, 2275 days ago, and no longer receives security fixes. The most recent release in this series is 1.9.16. 2 CVEs are tracked for this series. 2 of them were published after the end of life of the affected cycle and will not get an official patch. The next major version is HAProxy 2. See HAProxy 2 →
HAProxy 1.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 1.9 | Dec 19, 2018 | — | Jul 31, 2020 | 1.9.16 | EOL | |
| 1.8 | Nov 26, 2017 | — | Dec 9, 2022 | 1.8.31 | EOL | |
| 1.7 | Nov 25, 2016 | — | Oct 1, 2021 | 1.7.14 | EOL | |
| 1.6 | Oct 13, 2015 | — | Oct 1, 2020 | 1.6.16 | EOL | |
| 1.5 | Jun 19, 2014 | — | Jan 10, 2020 | 1.5.19 | EOL | |
| 1.4 | Feb 26, 2010 | — | Jan 10, 2020 | 1.4.27 | EOL | |
| 1.3 | Jun 29, 2006 | — | Mar 14, 2016 | 1.3.28 | EOL | |
| 1.2 | Nov 9, 2003 | — | Aug 6, 2011 | 1.2.18 | EOL | |
| 1.1 | Mar 10, 2002 | — | Jan 29, 2006 | 1.1.34 | EOL | |
| 1.0 | Dec 16, 2001 | — | Dec 30, 2001 | 1.0.2 | EOL |
CVEs affecting HAProxy 1.x (20)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.2 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.4 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.9 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.7 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.5 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.8 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.1 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.6 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.0 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 1.3 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.6 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.2 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.8 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.4 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.3 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.9 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.1 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.7 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.0 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 1.5 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
HAProxy 1.x is EOL — migrate to HAProxy 2.x
HAProxy 2.x is the next major release. Plan your upgrade before HAProxy 1.x stops receiving security patches.
Add a HAProxy 1 EOL badge to your README
Show your users which HAProxy version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/haproxy/1)Frequently asked questions
Is HAProxy 1 end of life?
Yes. All HAProxy 1.x releases have reached end of life and no longer receive security patches. There are 2 known CVEs affecting HAProxy 1.x. Migrate to HAProxy 2.x as soon as possible.
What CVEs affect HAProxy 1?
There are 2 CVEs tracked for HAProxy 1.x. See the full list above with CVSS and EPSS scores.
What is the latest HAProxy 1 version?
The latest HAProxy 1.x patch release is 1.9.16, released on July 31, 2020. Always run the latest patch to benefit from all security fixes.
How to migrate from HAProxy 1 to HAProxy 2?
To migrate from HAProxy 1 to HAProxy 2: (1) review the official HAProxy 2 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run HAProxy 1 in production?
No. HAProxy 1 has reached end of life and security vulnerabilities are no longer patched. Upgrade to a supported version immediately.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA