H
HAProxy 2.x — End of Life
Active High risk EOL: Mar 21, 202510 releases in this series24 CVEs
HAProxy 2.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 2.9 | Dec 5, 2023 | — | Mar 21, 2025 | 2.9.15 | EOL | |
| 2.8LTS | May 31, 2023 | — | Apr 1, 2028 | 2.8.26 | Active | |
| 2.7 | Dec 1, 2022 | — | Apr 5, 2024 | 2.7.12 | EOL | |
| 2.6LTS | May 31, 2022 | — | Apr 1, 2027 | 2.6.31 | Active | |
| 2.5 | Nov 23, 2021 | — | May 2, 2023 | 2.5.14 | EOL | |
| 2.4LTS | May 14, 2021 | — | Apr 1, 2026 | 2.4.36 | EOL | |
| 2.3 | Nov 5, 2020 | — | Jul 27, 2022 | 2.3.21 | EOL | |
| 2.2LTS | Jul 7, 2020 | — | Apr 23, 2025 | 2.2.34 | EOL | |
| 2.1 | Nov 25, 2019 | — | Mar 18, 2021 | 2.1.12 | EOL | |
| 2.0 | Jun 16, 2019 | — | Apr 5, 2024 | 2.0.35 | EOL |
CVEs affecting HAProxy 2.x (24)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.2 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.6 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.7 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.4 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.0 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.1 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.8 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.9 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.5 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.3 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.4 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.0 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.6 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.7 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.5 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.9 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.1 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.3 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.2 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 2.8 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.30% | — | 2.9 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.30% | — | 2.8 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.30% | — | 2.7 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.30% | — | 2.6 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
HAProxy 2.x will reach end of life — migrate to HAProxy 3.x
HAProxy 3.x is the next major release. Plan your upgrade before HAProxy 2.x stops receiving security patches.
Frequently asked questions
Is HAProxy 2 end of life?
Partially. Some HAProxy 2.x releases have reached EOL. Check the version table above for the exact status of each sub-release.
What CVEs affect HAProxy 2?
There are 24 CVEs tracked for HAProxy 2.x. See the full list above with CVSS and EPSS scores.
What is the latest HAProxy 2 version?
The latest HAProxy 2.x patch release is 2.9.15, released on March 21, 2025. Always run the latest patch to benefit from all security fixes.
How to migrate from HAProxy 2 to HAProxy 3?
To migrate from HAProxy 2 to HAProxy 3: (1) review the official HAProxy 3 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run HAProxy 2 in production?
HAProxy 2 is still supported and safe for production use until March 21, 2025. Ensure you are running the latest patch version (2.9.15) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA