On 2026-10-17 17:39, Carlos Henrique Lima Melara wrote:
Salvatore mentioned in #debian-lts that you may want to do the update of
haproxy to bookworm-security, so I'm mailing you to check that.
Debian bookworm is LTS [1] and updates are handled by LTS team rather
than secteam or release team. You can prepare and upload the update as
you do for stable-security, the only caveat is after the upload and
build by buildds, it will be published immediately in bookworm-security.
So, if you upload there and prefer the LTS team to handle the paperwork,
just let us know at [email protected].
We also have a very good documentation on the lts-team page [2] to
assist anyone wanting to make a LTS update. All DDs can upload to
bookworm-security at security-master queue.
Hello,
I have uploaded 2.6.12-1+deb12u4 through Debusine:
https://debusine.debian.net/debian/developers/work-request/1474656/#work_request
I have run the regression tests and they all pass, except a few expected
failures (OpenSSL output changed). I have included the two security
issues that will be pushed to trixie-security. They don't have CVE
numbers yet. I have also included a fix for CVE-2026-33555 that didn't
made it to bookworm-security in the past.
haproxy (2.6.12-1+deb12u4) bookworm-security; urgency=high
* BUG/MAJOR: mux-h2: properly handle short reads on PING frames
* BUG/MAJOR: h1-htx: report an error on a too long chunk-size line
* BUG/MAJOR: h3: check body size with content-length on empty FIN
(CVE-2026-33555)
-- Vincent Bernat <[email protected]> Sat, 17 Oct 2026 19:17:39 +0200
I let you handle the paperwork.
Thanks!
