HAProxy 2.x — End of Life
Active High riskHAProxy 2.x is partially supported: only 2.8, 2.6 still receive security fixes, the longest-lived (2.8) until Apr 1, 2028, in 526 days. The most recent release in this series is 2.9.15. 4 CVEs are tracked for this series. 3 of them were published after the end of life of the affected cycle and will not get an official patch. The next major version is HAProxy 3. See HAProxy 3 →
HAProxy 2.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 2.9 | Dec 5, 2023 | — | Mar 21, 2025 | 2.9.15 | EOL | |
| 2.8LTS | May 31, 2023 | — | Apr 1, 2028 | 2.8.31 | Active | |
| 2.7 | Dec 1, 2022 | — | Apr 5, 2024 | 2.7.12 | EOL | |
| 2.6LTS | May 31, 2022 | — | Apr 1, 2027 | 2.6.35 | Active | |
| 2.5 | Nov 23, 2021 | — | May 2, 2023 | 2.5.14 | EOL | |
| 2.4LTS | May 14, 2021 | — | Apr 1, 2026 | 2.4.36 | EOL | |
| 2.3 | Nov 5, 2020 | — | Jul 27, 2022 | 2.3.21 | EOL | |
| 2.2LTS | Jul 7, 2020 | — | Apr 23, 2025 | 2.2.34 | EOL | |
| 2.1 | Nov 25, 2019 | — | Mar 18, 2021 | 2.1.12 | EOL | |
| 2.0 | Jun 16, 2019 | — | Apr 5, 2024 | 2.0.35 | EOL |
CVEs affecting HAProxy 2.x (27)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.2 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.9 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.0 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.3 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.1 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.7 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.8 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.6 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.5 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 2.4 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.3 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.2 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.6 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.7 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.4 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.0 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.1 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.8 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.9 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.33% | — | 2.5 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.57% | — | 2.7 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.57% | — | 2.9 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.57% | — | 2.6 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.57% | — | 2.8 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2025-11230 | HIGH | 7.5 | — | — | 2.6 | Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially … | Nov 19, 2025 |
| CVE-2025-11230 | HIGH | 7.5 | — | — | 2.8 | Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially … | Nov 19, 2025 |
| CVE-2025-11230 | HIGH | 7.5 | — | — | 2.4 | Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially … | Nov 19, 2025 |
HAProxy 2.x will reach end of life — migrate to HAProxy 3.x
HAProxy 3.x is the next major release. Plan your upgrade before HAProxy 2.x stops receiving security patches.
Add a HAProxy 2 EOL badge to your README
Show your users which HAProxy version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/haproxy/2)Frequently asked questions
Is HAProxy 2 end of life?
Partially. 8 of the 10 HAProxy 2.x releases have reached end of life. Still supported: 2.8, 2.6 (until April 1, 2028 at the latest).
What CVEs affect HAProxy 2?
There are 4 CVEs tracked for HAProxy 2.x. See the full list above with CVSS and EPSS scores.
What is the latest HAProxy 2 version?
The latest HAProxy 2.x patch release is 2.9.15, released on March 21, 2025. Always run the latest patch to benefit from all security fixes.
How to migrate from HAProxy 2 to HAProxy 3?
To migrate from HAProxy 2 to HAProxy 3: (1) review the official HAProxy 3 migration guide for breaking changes, (2) update dependencies and configuration accordingly, (3) test thoroughly in a staging environment, (4) deploy with a rollback plan. Starting early gives you time to resolve compatibility issues before your current version reaches end of life.
Is it safe to run HAProxy 2 in production?
Only on a supported release (2.8, 2.6). Support for HAProxy 2.8 ends on April 1, 2028. Make sure you run the latest patch (2.8.31) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA