Here are the results of haproxy test suite running against those builds: Old, unpatched 2.4.30-0ubuntu0.22.04.2:
########################## Starting vtest ########################## Testing with haproxy version: 2.4.30-0ubuntu0.22.04.2 0 tests failed, 3 tests skipped, 141 tests passed Patched build introducing the regression (2.4.30-0ubuntu0.22.04.3): ########################## Starting vtest ########################## Testing with haproxy version: 2.4.30-0ubuntu0.22.04.3 # top TEST reg-tests/cache/if-modified-since.vtc FAILED (0.180) exit=2 # top TEST reg-tests/http-messaging/http_bodyless_response.vtc FAILED (0.391) exit=2 # top TEST reg-tests/http-messaging/truncated.vtc TIMED OUT (kill -9) # top TEST reg-tests/http-messaging/truncated.vtc FAILED (10.008) signal=9 3 tests failed, 3 tests skipped, 138 tests passed ########################## Gathering results ########################## ###### Test case: reg-tests/cache/if-modified-since.vtc ###### ## test results in: "/tmp/haregtests-2026-11-05_11-17-03.Zmzalp/vtc.47599.14563006" ---- s1 HTTP header is incomplete ---- c1 HTTP rx EOF (fd:8 read: Success) 1 ###### Test case: reg-tests/http-messaging/http_bodyless_response.vtc ###### ## test results in: "/tmp/haregtests-2026-11-05_11-17-03.Zmzalp/vtc.47599.22a24235" ---- s1 HTTP header is incomplete ###### Test case: reg-tests/http-messaging/truncated.vtc ###### ## test results in: "/tmp/haregtests-2026-11-05_11-17-03.Zmzalp/vtc.47599.5971f604" ---- c1h2.1 EXPECT resp.status (502) == "200" failed make: *** [Makefile:1116: reg-tests] Error 1 Proposed fix (2.4.30-0ubuntu0.22.04.4): ########################## Starting vtest ########################## Testing with haproxy version: 2.4.30-0ubuntu0.22.04.4 0 tests failed, 3 tests skipped, 141 tests passed FWIW, haproxy 2.8 in Noble (24.04) is NOT affected (tested against test suite of 2.8.30): ########################## Starting vtest ########################## Testing with haproxy version: 2.8.30-0ubuntu0.24.04.2 Warning: version does not match the current tree (2.8.30) 0 tests failed, 18 tests skipped, 185 tests passed There is no support or backports available for Haproxy 2.4 from the upstream haproxy project, because 2.4 is unmaintained since 2026 Q2 (see haproxy.org). This means that Ubuntu maintainers need to backport the fixes on their own, to code that may have significantly changed. This introduces additional risk. When you use a Ubuntu LTS version that ships a haproxy version that is supported upstream, like haproxy 2.8 in Ubuntu 24.04, this means that the Ubuntu maintainers just use the patch available from the upstream project and that is it. So in other words, running Ubuntu LTS version right up until their EOL (22.04 will be EOLed in less than 6 months) or even further with ESM can increase the risk of regressions in certain scenarios. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172897 Title: haproxy 2.4.30-0ubuntu0.22.04.3: CVE-2026-110354 backport causes intermittent 502 (PH) on valid chunked responses To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
