This bug was fixed in the package haproxy - 3.2.25-0ubuntu0.26.04.1
---------------
haproxy (3.2.25-0ubuntu0.26.04.1) resolute; urgency=medium
* New upstream version (LP: #2153485):
Major bugs fixed:
- mux_quic: fix potential crash on RESET_STREAM receive
- h3: reject H3 truncated frames
- htx: Check the header/trailer length limits when one is updated
- mux_quic: fix leak on RESET_STREAM reception
- ssl/ocsp: lock the OCSP response around reads in the stapling callback
- htx: Don't swap buffers for empty HTX message with an error
- mux-h2: preset MSGF_BODY_CL on H2_SF_DATA_CLEN in h2c_dec_hdrs()
- http: forbid comma character in authority value
- http-htx: Store new host in a chunk for scheme-based normalization
- mux-h1: Deal with true 64-bits integer to emit chunks size
- slz: always make sure to limit fixed output to less than worst case
literals
- sched: protect task->expire on 32-bit platforms
- mux-h2: detect incomplete transfers on HEADERS frames as well
- h3: check body size with content-length on empty FIN
- qpack: unchecked length passed to huffman decoder
- fcgi: Fix param decoding by properly checking its size
- resolvers: Properly lowered the names found in DNS response
- Revert "MEDIUM: mux-quic: add BUG_ON if sending on locally closed QCS"
- applet: Don't call I/O handler if the applet was shut
- quic: reject invalid token
- quic: fix parsing frame type
* Dropped changes:
- d/p/CVE-2026-26080: removed [upstream in 3.2.12]
- d/p/CVE-2026-26081: removed [upstream in 3.2.12]
- d/p/quic-fix-1: removed [upstream in 3.2.13]
- d/p/quic-fix-2: removed [upstream in 3.2.13]
- d/p/CVE-2026-33555: removed [upstream in 3.2.15]
- d/p/CVE-2026-55203: removed [upstream in 3.2.20]
- d/p/CVE-2026-55204: removed [upstream in 3.2.20]
-- Jonas Jelten <[email protected]> Thu, 24 Sep 2026 15:18:56 +0200
** Changed in: haproxy (Ubuntu Resolute)
Status: Fix Committed => Fix Released
** CVE added: https://cve.org/CVERecord?id=CVE-2026-26080
** CVE added: https://cve.org/CVERecord?id=CVE-2026-26081
** CVE added: https://cve.org/CVERecord?id=CVE-2026-33555
** CVE added: https://cve.org/CVERecord?id=CVE-2026-55203
** CVE added: https://cve.org/CVERecord?id=CVE-2026-55204
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2153485
Title:
Backport haproxy for stonking cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2153485/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
