The vulnerability arises from improper handling of varint values, causing HAProxy to enter an infinite loop or crash. This results in a denial of service that can bring the load‑balancing service offline, disrupting availability for downstream applications. The detailed impact is inferred from the description.

HAProxy Community Edition versions 3.2.x and 3.3.x before 3.3.3, as well as HAProxy Enterprise and ALOHA, are affected. The bug is tied to the core varint parsing logic and applies to all builds of these products in the mentioned version ranges.

The CVSS score of 3.7 places the issue in the low category, and the EPSS score of < 1% indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation so far. Attackers would need to craft traffic that includes malformed varints; the loop or crash typically occurs during normal packet processing, so the attack could be performed remotely from outside the network. The likely attack vector is inferred from the description that malformed varints can be included in external traffic.