We are seeing what appears to be the same regression on Ubuntu 22.04 after upgrading HAProxy from 2.4.30-0ubuntu0.22.04.2 to 2.4.30-0ubuntu0.22.04.3.
Environment Ubuntu 22.04 LTS HAProxy 2.4.30-0ubuntu0.22.04.3 Backend architecture: Client -> HAProxy -> nginx 1.20.1 -> Tomcat 9.0.39 Symptoms Immediately after the upgrade we started seeing intermittent HTTP 502 errors on multiple independent backend applications. HAProxy logs: PH-- 502 Example: <ip.addr>:39810 [05/Nov/2026:14:08:56.236] http-in~ special_backend30/special_backend30 0/0/0/-1/13 502 2032 - - PH-- "GET https://domain.tld/ HTTP/2.0" The issue affected several unrelated backends simultaneously: production_backend14 production_backend21 production_backend23 production_backend30 No changes had been made to the applications, nginx, Tomcat or backend operating systems. HAProxy "show errors" Immediately after a failure: backend special_backend30 (#52): invalid response H1 msg state MSG_CHUNK_SIZE(26) H1 chunk len 0 bytes H1 body len 1392 bytes Similar errors were observed on multiple backends. Packet capture A packet capture taken between HAProxy and the backend showed that the backend did successfully return a response: HTTP HTTP/1.1 200 Content-Encoding: gzip Transfer-Encoding: chunked Connection: close Despite receiving the response, HAProxy subsequently generated: PH-- 502 Tomcat behaviour Direct requests to Tomcat on port 8080 show: Without compression: HTTP HTTP/1.1 200 Content-Length: 4782 With: HTTP Accept-Encoding: gzip, deflate, br, zstd Tomcat returns: HTTP HTTP/1.1 200 Content-Encoding: gzip Transfer-Encoding: chunked This matches the code path in which HAProxy later reports: MSG_CHUNK_SIZE Resolution Downgrading HAProxy to: 2.4.30-0ubuntu0.22.04.2 immediately resolved the issue. After downgrade: No more PH-- No more MSG_CHUNK_SIZE errors No more 502 responses Why this looks related The regression appeared immediately after installation of: 2.4.30-0ubuntu0.22.04.3 which includes the patch for: CVE-2026-110354 BUG/MAJOR: h1-htx: report an error on a too long chunk-size line src/h1_htx.c The errors we observe are consistently reported in: MSG_CHUNK_SIZE and disappear completely after reverting to .2. This strongly suggests a regression in the HTTP/1 chunk parsing code path introduced by the Ubuntu patch set. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172897 Title: haproxy 2.4.30-0ubuntu0.22.04.3: CVE-2026-110354 backport causes intermittent 502 (PH) on valid chunked responses To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
