Package "vim-haproxy"

  haproxy (3.0.12-0ubuntu0.25.10.3) questing-security; urgency=medium

  * SECURITY UPDATE: crash via INITIAL packet for the NEW_TOKEN format
    - debian/patches/quic-reject-invalid-token.patch: reject invalid token
      in src/quic_token.c.
    - CVE-2026-26081

 -- Marc Deslauriers <email address hidden> Tue, 10 Feb 2026 07:50:15 -0500

  haproxy (3.0.12-0ubuntu0.25.10.1) questing; urgency=medium

  * New upstream version (LP: #2127664)
    - The API for the lua HTTPMessage "class" was improved to be able to
      change the body length. It was mandatory to be able to write a lua
      filter altering the message payload. HTTPMessage:set_body_len() can now
      be used for this purpose
    - Still in lua, The HTTP client is not supposed to be used to process
      several requests but there was nothing to prevent this usage. An error
      is now triggered in that case
    - The "ssl_bc_sni" sample fetch function was backported. It can be useful
      during debugging sessions to know what SNI was configured on a
      connection going to a server, for example to match it against what the
      server saw or to detect cases where a server would route on SNI instead
      of Host.
    - For further information, see the upstream release notes:
      + https://<email address hidden>/msg45931.html
      + https://<email address hidden>/msg46205.html
  * d/p/CVE-2025-11230.patch: drop patch fixed upstream in 3.0.12

 -- Athos Ribeiro <email address hidden> Mon, 01 Dec 2025 10:53:47 -0300