Package "haproxy"

haproxy (2.8.30-0ubuntu0.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: DoS via truncated HTTP/2 PING frame
    - debian/patches/CVE-2026-110353.patch: BUG/MEDIUM: mux-h1: only accept the
      H2 preface on the first request in src/mux_h1.c.
    - CVE-2026-110353
  * SECURITY UPDATE: DoS via HTTP/1.1 chunked request
    - debian/patches/CVE-2026-110354.patch: BUG/MAJOR: h1-htx: report an error
      on a too long chunk-size line in reg-tests/http-
      messaging/h1_big_chunk_size_line.vtc, src/h1_htx.c.
    - CVE-2026-110354

 -- Marc Deslauriers Tue, 27 Oct 2026 16:01:12 -0500

haproxy (2.8.30-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version (LP: #2153485):
    Major bugs fixed:
    - mux_quic: fix potential crash on RESET_STREAM receive
    - h3: reject H3 truncated frames
    - htx: Check the header/trailer length limits when one is updated
    - mux_quic: fix leak on RESET_STREAM reception
    - ssl/ocsp: lock the OCSP response around reads in the stapling callback
    - htx: Don't swap buffers for empty HTX message with an error
    - mux-h2: preset MSGF_BODY_CL on H2_SF_DATA_CLEN in h2c_dec_hdrs()
    - http: forbid comma character in authority value
    - http-htx: Store new host in a chunk for scheme-based normalization
    - slz: always make sure to limit fixed output to less than worst case literals
    - mux-h2: detect incomplete transfers on HEADERS frames as well
    - h3: check body size with content-length on empty FIN
    - qpack: unchecked length passed to huffman decoder
    - fcgi: Fix param decoding by properly checking its size
    - resolvers: Properly lowered the names found in DNS response
    - stream: Force channel analysis on successful synchronous send
    - quic: use ncbmbuf for CRYPTO handling
  * Dropped changes:
    - d/p/CVE-2026-33555 [upstream in 2.8.20]
    - d/p/CVE-2026-55203 [upstream in 2.8.25]
    - d/p/CVE-2026-55204 [upstream in 2.8.25]

 -- Jonas Jelten Tue, 06 Oct 2026 16:39:22 +0200

  haproxy (2.8.16-0ubuntu0.24.04.3) noble-security; urgency=medium

  * SECURITY UPDATE: overflow in FCGI demux record length field
    - debian/patches/CVE-2026-55203.patch: mux-fcgi: fix uint16_t overflow in
      drl += drp in src/mux_fcgi.c.
    - CVE-2026-55203
  * SECURITY UPDATE: NULL dereference in hpack_dht_insert()
    - debian/patches/CVE-2026-55204.patch: hpack-tbl: add missing NULL check
      after hpack_dht_defrag() in src/hpack-tbl.c.
    - CVE-2026-55204

 -- Marc Deslauriers <email address hidden> Fri, 19 Jun 2026 11:04:08 -0400

  haproxy (2.8.16-0ubuntu0.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: HTTP/3 parser request smuggling issue
    - debian/patches/CVE-2026-33555.patch: check body size with
      content-length on empty FIN in src/h3.c.
    - CVE-2026-33555

 -- Marc Deslauriers <email address hidden> Wed, 15 Apr 2026 14:04:24 -0400

  haproxy (2.8.16-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version (LP: #2127664)
    - The API for the lua HTTPMessage "class" was improved to be able to
      change the body length. It was mandatory to be able to write a lua
      filter altering the message payload. HTTPMessage:set_body_len() can now
      be used for this purpose
    - Still in lua, The HTTP client is not supposed to be used to process
      several requests but there was nothing to prevent this usage. An error
      is now triggered in that case
    - For further information, see the upstream release notes:
      + https://<email address hidden>/msg46201.html
  * d/p/CVE-2025-11230.patch: drop patch fixed upstream in 2.8.16

 -- Athos Ribeiro <email address hidden> Wed, 03 Dec 2025 12:12:24 -0300