On Thu, Nov 05, 2026 at 02:03:53PM +0100, Lukas Tribus wrote: > On Wed, 4 Nov 2026 at 17:46, Lukas Tribus <[email protected]> wrote: > > > > On Wed, 4 Nov 2026 at 15:15, Vincent Bernat <[email protected]> wrote: > > > > > > On 2026-11-04 10:41, Lukas Tribus wrote: > > > > > > > this is a heads-up only, nothing we can do: > > > > > > > > Ubuntu backported 2e4ba6a5708 ("BUG/MAJOR: h1-htx: report an error on > > > > a too long chunk-size line") for CVE-2026-110354 to Haproxy 2.4 for > > > > their Ubuntu 22.04 repositories that will be EOL in April 2027. > > > > > > > > Apparently that backport introduced a regression that is breaking > > > > legitimate requests: > > > > > > > > https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897 > > > > https://discourse.haproxy.org/t/regression-in-ubuntu-22-04-haproxy-security-update-http-1-1-chunked-responses-cause-502-bad-gateway/12804/2 > > > > > > Hello Lukas, > > > > > > In Debian, we backported to 2.6. I did run the regression tests. Out of > > > curiosity, do you know if the regression would have been caught by the > > > regression tests? > > > > I don't believe the regression tests > > I was wrong, the regression tests cought it, see below. > > Of course 2.4 is unmaintained, so this was not a simple backport but > the Ubuntu maintainer had to write it's own. I'm attaching the 2 > changes here for the record. > > > Old, unpatched 2.4.30-0ubuntu0.22.04.2: > > ########################## Starting vtest ########################## > Testing with haproxy version: 2.4.30-0ubuntu0.22.04.2 > 0 tests failed, 3 tests skipped, 141 tests passed > > > > Patches build introducing the regression (2.4.30-0ubuntu0.22.04.3): > > ########################## Starting vtest ########################## > Testing with haproxy version: 2.4.30-0ubuntu0.22.04.3 > # top TEST reg-tests/cache/if-modified-since.vtc FAILED (0.180) exit=2 > # top TEST reg-tests/http-messaging/http_bodyless_response.vtc > FAILED (0.391) exit=2 > # top TEST reg-tests/http-messaging/truncated.vtc TIMED OUT (kill -9) > # top TEST reg-tests/http-messaging/truncated.vtc FAILED (10.008) signal=9 > 3 tests failed, 3 tests skipped, 138 tests passed > ########################## Gathering results ########################## > ###### Test case: reg-tests/cache/if-modified-since.vtc ###### > ## test results in: > "/tmp/haregtests-2026-11-05_11-17-03.Zmzalp/vtc.47599.14563006" > ---- s1 HTTP header is incomplete > ---- c1 HTTP rx EOF (fd:8 read: Success) 1 > ###### Test case: reg-tests/http-messaging/http_bodyless_response.vtc ###### > ## test results in: > "/tmp/haregtests-2026-11-05_11-17-03.Zmzalp/vtc.47599.22a24235" > ---- s1 HTTP header is incomplete > ###### Test case: reg-tests/http-messaging/truncated.vtc ###### > ## test results in: > "/tmp/haregtests-2026-11-05_11-17-03.Zmzalp/vtc.47599.5971f604" > ---- c1h2.1 EXPECT resp.status (502) == "200" failed > make: *** [Makefile:1116: reg-tests] Error 1 > > > Proposed fix (2.4.30-0ubuntu0.22.04.4): > > ########################## Starting vtest ########################## > Testing with haproxy version: 2.4.30-0ubuntu0.22.04.4 > 0 tests failed, 3 tests skipped, 141 tests passed
Nice work, thank you Lukas! I'm not even sure 2.4 needed the fix at all, because the commit message says: This should be backported at least to 3.0. But possibly to all stable versions with some modifications. However, no loop can be experienced on 2.8 and 2.6. I.e. we couldn't reproduce the issue before 3.0, which doesn't guarantee they're immune but at least that the code there doesn't work the same way, the regtest won't trigger, and any behavior change might possibly untune it rather than fix something. Given that the patch was in 2.6, I can understand why the maintainers preferred to take it, but honestly on this one it would have been easier to ask us for confirmation. Cheers, Willy
