On Wed, 4 Nov 2026 at 15:15, Vincent Bernat <[email protected]> wrote: > > On 2026-11-04 10:41, Lukas Tribus wrote: > > > this is a heads-up only, nothing we can do: > > > > Ubuntu backported 2e4ba6a5708 ("BUG/MAJOR: h1-htx: report an error on > > a too long chunk-size line") for CVE-2026-110354 to Haproxy 2.4 for > > their Ubuntu 22.04 repositories that will be EOL in April 2027. > > > > Apparently that backport introduced a regression that is breaking > > legitimate requests: > > > > https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897 > > https://discourse.haproxy.org/t/regression-in-ubuntu-22-04-haproxy-security-update-http-1-1-chunked-responses-cause-502-bad-gateway/12804/2 > > Hello Lukas, > > In Debian, we backported to 2.6. I did run the regression tests. Out of > curiosity, do you know if the regression would have been caught by the > regression tests?
I don't believe the regression tests shipped with the backport would have caught the Ubuntu regression because it tests for the CVE (the loop affecting haproxy 3.0+), not properly working chunked transfer-ecodings (which is the regression in Ubuntu): http://git.haproxy.org/?p=haproxy-2.6.git;a=blob;f=reg-tests/http-messaging/h1_big_chunk_size_line.vtc;h=4c7340af576e9c6920f529bf2a3bddec58a56372;hb=68609955873ff845220b7a7cf22147d3617a0b42 I'm not *that* familiar with the regression testing suite, seems to me we are testing a lot of edge cases, but I cannot find a tests that covers forwarding legitimate H1 chunks properly. Lukas Lukas
