On Wed, 4 Nov 2026 at 17:46, Lukas Tribus <[email protected]> wrote: > > On Wed, 4 Nov 2026 at 15:15, Vincent Bernat <[email protected]> wrote: > > > > On 2026-11-04 10:41, Lukas Tribus wrote: > > > > > this is a heads-up only, nothing we can do: > > > > > > Ubuntu backported 2e4ba6a5708 ("BUG/MAJOR: h1-htx: report an error on > > > a too long chunk-size line") for CVE-2026-110354 to Haproxy 2.4 for > > > their Ubuntu 22.04 repositories that will be EOL in April 2027. > > > > > > Apparently that backport introduced a regression that is breaking > > > legitimate requests: > > > > > > https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897 > > > https://discourse.haproxy.org/t/regression-in-ubuntu-22-04-haproxy-security-update-http-1-1-chunked-responses-cause-502-bad-gateway/12804/2 > > > > Hello Lukas, > > > > In Debian, we backported to 2.6. I did run the regression tests. Out of > > curiosity, do you know if the regression would have been caught by the > > regression tests? > > I don't believe the regression tests
I was wrong, the regression tests cought it, see below. Of course 2.4 is unmaintained, so this was not a simple backport but the Ubuntu maintainer had to write it's own. I'm attaching the 2 changes here for the record. Old, unpatched 2.4.30-0ubuntu0.22.04.2: ########################## Starting vtest ########################## Testing with haproxy version: 2.4.30-0ubuntu0.22.04.2 0 tests failed, 3 tests skipped, 141 tests passed Patches build introducing the regression (2.4.30-0ubuntu0.22.04.3): ########################## Starting vtest ########################## Testing with haproxy version: 2.4.30-0ubuntu0.22.04.3 # top TEST reg-tests/cache/if-modified-since.vtc FAILED (0.180) exit=2 # top TEST reg-tests/http-messaging/http_bodyless_response.vtc FAILED (0.391) exit=2 # top TEST reg-tests/http-messaging/truncated.vtc TIMED OUT (kill -9) # top TEST reg-tests/http-messaging/truncated.vtc FAILED (10.008) signal=9 3 tests failed, 3 tests skipped, 138 tests passed ########################## Gathering results ########################## ###### Test case: reg-tests/cache/if-modified-since.vtc ###### ## test results in: "/tmp/haregtests-2026-11-05_11-17-03.Zmzalp/vtc.47599.14563006" ---- s1 HTTP header is incomplete ---- c1 HTTP rx EOF (fd:8 read: Success) 1 ###### Test case: reg-tests/http-messaging/http_bodyless_response.vtc ###### ## test results in: "/tmp/haregtests-2026-11-05_11-17-03.Zmzalp/vtc.47599.22a24235" ---- s1 HTTP header is incomplete ###### Test case: reg-tests/http-messaging/truncated.vtc ###### ## test results in: "/tmp/haregtests-2026-11-05_11-17-03.Zmzalp/vtc.47599.5971f604" ---- c1h2.1 EXPECT resp.status (502) == "200" failed make: *** [Makefile:1116: reg-tests] Error 1 Proposed fix (2.4.30-0ubuntu0.22.04.4): ########################## Starting vtest ########################## Testing with haproxy version: 2.4.30-0ubuntu0.22.04.4 0 tests failed, 3 tests skipped, 141 tests passed Lukas
U2204-haproxy24-CVE-2026-110354-regression-fix.patch
Description: Binary data
U2204-haproxy24-CVE-2026-110354.patch
Description: Binary data
