CVE-2026-109575: Data Plane API EE 2.2.0-ee1 through 2.9.28-ee1; status changes: 2.9.29-ee1 — unaffected, 3.0-ee through 3.0.24-ee1…

Affected technology

Data Plane API EE · 2.2.0-ee1 through 2.9.28-ee1; status changes: 2.9.29-ee1 — unaffected, 3.0-ee through 3.0.24-ee1; status changes: 3.0.25-ee1 — unaffected, 3.1-ee through 3.2.16-ee1; status changes: 3.2.17-ee1 — unaffected, 3.3-ee through 3.3.8-ee1; status changes: 3.3.9-ee1 — unaffected, 3.4-ee through 3.4.3-ee2; status changes: 3.4.4-ee1 — unaffected
HAProxy

Data Plane API CE · 2.2.0 through 2.9.28; status changes: 2.9.29 — unaffected, 3.0.0 through 3.0.24; status changes: 3.0.25 — unaffected, 3.1.0 through 3.2.16; status changes: 3.2.17 — unaffected, 3.3.0 through 3.3.8; status changes: 3.3.9 — unaffected, 3.4.0 through 3.4.3; status changes: 3.4.4 — unaffected
HAProxy

Description’s affected range: through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI()

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.