On 2026-11-04 10:41, Lukas Tribus wrote:
this is a heads-up only, nothing we can do:
Ubuntu backported 2e4ba6a5708 ("BUG/MAJOR: h1-htx: report an error on
a too long chunk-size line") for CVE-2026-110354 to Haproxy 2.4 for
their Ubuntu 22.04 repositories that will be EOL in April 2027.
Apparently that backport introduced a regression that is breaking
legitimate requests:
https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897
https://discourse.haproxy.org/t/regression-in-ubuntu-22-04-haproxy-security-update-http-1-1-chunked-responses-cause-502-bad-gateway/12804/2
Hello Lukas,
In Debian, we backported to 2.6. I did run the regression tests. Out of
curiosity, do you know if the regression would have been caught by the
regression tests?
Thanks.
