UbuntuUpdates.org

Package "haproxy"

Name: haproxy

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • fast and reliable load balancing reverse proxy (HTML documentation)
  • syntax highlighting for HAProxy configuration files
Latest version: 2.8.30-0ubuntu0.24.04.1
Release: noble (24.04)
Level: proposed
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "haproxy" in Noble

Repository Area Version
base universe 2.8.5-1ubuntu3
base main 2.8.5-1ubuntu3
security universe 2.8.16-0ubuntu0.24.04.3
security main 2.8.16-0ubuntu0.24.04.3
updates main 2.8.16-0ubuntu0.24.04.3
updates universe 2.8.16-0ubuntu0.24.04.3
proposed main 2.8.30-0ubuntu0.24.04.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.8.30-0ubuntu0.24.04.1 2026-10-14 23:07:46 UTC

haproxy (2.8.30-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version (LP: #2153485):
    Major bugs fixed:
    - mux_quic: fix potential crash on RESET_STREAM receive
    - h3: reject H3 truncated frames
    - htx: Check the header/trailer length limits when one is updated
    - mux_quic: fix leak on RESET_STREAM reception
    - ssl/ocsp: lock the OCSP response around reads in the stapling callback
    - htx: Don't swap buffers for empty HTX message with an error
    - mux-h2: preset MSGF_BODY_CL on H2_SF_DATA_CLEN in h2c_dec_hdrs()
    - http: forbid comma character in authority value
    - http-htx: Store new host in a chunk for scheme-based normalization
    - slz: always make sure to limit fixed output to less than worst case literals
    - mux-h2: detect incomplete transfers on HEADERS frames as well
    - h3: check body size with content-length on empty FIN
    - qpack: unchecked length passed to huffman decoder
    - fcgi: Fix param decoding by properly checking its size
    - resolvers: Properly lowered the names found in DNS response
    - stream: Force channel analysis on successful synchronous send
    - quic: use ncbmbuf for CRYPTO handling
  * Dropped changes:
    - d/p/CVE-2026-33555 [upstream in 2.8.20]
    - d/p/CVE-2026-55203 [upstream in 2.8.25]
    - d/p/CVE-2026-55204 [upstream in 2.8.25]

 -- Jonas Jelten Tue, 06 Oct 2026 16:39:22 +0200
2153485 Backport haproxy for stonking cycle
CVE-2026-33555 An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced conten
CVE-2026-55203 HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer
CVE-2026-55204 HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that

Version: *DELETED* 2026-01-23 22:17:31 UTC
No changelog for deleted or moved packages.

Version: 2.8.16-0ubuntu0.24.04.1 2026-01-08 23:08:42 UTC

  haproxy (2.8.16-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version (LP: #2127664)
    - The API for the lua HTTPMessage "class" was improved to be able to
      change the body length. It was mandatory to be able to write a lua
      filter altering the message payload. HTTPMessage:set_body_len() can now
      be used for this purpose
    - Still in lua, The HTTP client is not supposed to be used to process
      several requests but there was nothing to prevent this usage. An error
      is now triggered in that case
    - For further information, see the upstream release notes:
      + https://<email address hidden>/msg46201.html
  * d/p/CVE-2025-11230.patch: drop patch fixed upstream in 2.8.16

 -- Athos Ribeiro <email address hidden> Wed, 03 Dec 2025 12:12:24 -0300
2127664 New HAProxy upstream microreleases 2.4.30, 2.8.16, and 3.0.12
CVE-2025-11230 BUG/CRITICAL: mjson: fix possible DoS when parsing numbers

Version: *DELETED* 2025-11-16 17:06:59 UTC
No changelog for deleted or moved packages.

Version: 2.8.15-0ubuntu0.24.04.1 2025-10-23 23:07:19 UTC

  haproxy (2.8.15-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version (LP: #2112526)
    - This new release introduce several fixes, including bug fixes for QUIC,
      for the SSL stack, and LUA.
    - New configuration options were introduced, and a new default value for
      the hard limit on the number of file descriptors was introduced. These
      are described in the Debian NEWS file.
    - For further information, see the upstream release notes:
      + https://<email address hidden>/msg44606.html
      + https://<email address hidden>/msg44632.html
      + https://<email address hidden>/msg44787.html
      + https://<email address hidden>/msg44790.html
      + https://<email address hidden>/msg45060.html
      + https://<email address hidden>/msg45317.html
      + https://<email address hidden>/msg45413.html
      + https://<email address hidden>/msg45486.html
      + https://<email address hidden>/msg45570.html
      + https://<email address hidden>/msg45806.html
  * d/NEWS: add NEWS file.
  * Dropped paches applied upstream:
    - d/p/CVE-2024-53008-1.patch
    - d/p/CVE-2024-53008-2.patch
    - d/p/CVE-2025-32464.patch

 -- Athos Ribeiro <email address hidden> Wed, 08 Oct 2025 10:50:30 -0300
2112526 Micro release updates for jammy, noble, and plucky
CVE-2024-53008 Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remo
CVE-2025-32464 HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the repl


About   -   Send Feedback to @ubuntu_updates