H
HAProxy 3.x — End of Life
Active High risk EOL: Apr 1, 2031in 1711d5 releases in this series14 CVEs
HAProxy 3.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 3.4LTS | Jun 3, 2026 | — | Apr 1, 2031 | 3.4.2 | Active | |
| 3.3 | Nov 26, 2025 | — | Jan 1, 2027 | 3.3.12 | Active | |
| 3.2LTS | May 28, 2025 | — | Apr 1, 2030 | 3.2.21 | Active | |
| 3.1 | Nov 26, 2024 | — | Jan 1, 2026 | 3.1.17 | EOL | |
| 3.0LTS | May 29, 2024 | — | Apr 1, 2029 | 3.0.25 | Active |
CVEs affecting HAProxy 3.x (14)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 3.1 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 3.4 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 3.2 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 3.0 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55204 | HIGH | 7.5 | 0.48% | — | 3.3 | HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert()… | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 3.0 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 3.3 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 3.4 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 3.1 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-55203 | HIGH | 7.5 | 0.35% | — | 3.2 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's … | Jun 18, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.30% | — | 3.3 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.30% | — | 3.2 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.30% | — | 3.1 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
| CVE-2026-33555 | MEDIUM | 4.0 | 0.30% | — | 3.0 | An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches … | Apr 13, 2026 |
Frequently asked questions
Is HAProxy 3 end of life?
Partially. Some HAProxy 3.x releases have reached EOL. Check the version table above for the exact status of each sub-release.
What CVEs affect HAProxy 3?
There are 14 CVEs tracked for HAProxy 3.x. See the full list above with CVSS and EPSS scores.
What is the latest HAProxy 3 version?
The latest HAProxy 3.x patch release is 3.4.2, released on July 3, 2026. Always run the latest patch to benefit from all security fixes.
When was HAProxy 3 first released?
HAProxy 3.0 was initially released on June 3, 2026. See the full version timeline in the table above.
Is it safe to run HAProxy 3 in production?
HAProxy 3 is still supported and safe for production use until April 1, 2031. Ensure you are running the latest patch version (3.4.2) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA