Hi,
HAProxy 3.2.21 was released on 2026/07/03. It added 6 new commits
after version 3.2.20.
This release is pretty similar to the 3.3.12 and was emitted for the same
reason. It fixed an issue concerning the HTX API and affecting the FCGI.
Crashes could be experienced. This issue was revealed by a fix shipped in
the 3.2.20. Because it was released one week ago and probably not widely
deployed yet, we've decided to emit the 3.2.21 right away to prevent any
trouble. So, if you are running the 3.2.20 and you are using the FCGI, you
must upgrade. Otherwise, there is no reason to rush. While the H2 and QUIC
are theoretically affected, it seems pretty hard to hit this bug, except
with a misbehaving configuration.
Otherwise, some other pending fixes were brought with this release:
* The port_range allocated for a server's "source" directive was never
freed. This was not an issue with static configurations, but with
dynamic server addition/removal it led to a memory leak every time such
a server is destroyed. Both issues were fixed.
* In the QUIC multiplexer, freeing a stream did not release its receive
application buffer when it still held data or had been allocated,
causing a memory leak as streams were opened and closed over the
connection's lifetime. This was fixed by explicitly freeing this buffer
when the QUIC stream is released.
* The function responsible to merge Cookie header value during the message
parsing in H2 and QUIC was fixed to respect the HTX API. The bug was
ineffective but was waiting to be discovered.
Thanks everyone for your help on this release !
Please find the usual URLs below :
Site index : https://www.haproxy.org/
Documentation : https://docs.haproxy.org/
Wiki : https://github.com/haproxy/wiki/wiki
Discourse : https://discourse.haproxy.org/
Slack channel : https://slack.haproxy.org/
Issue tracker : https://github.com/haproxy/haproxy/issues
Q&A from devs : https://github.com/orgs/haproxy/discussions
Sources : https://www.haproxy.org/download/3.2/src/
Git repository : https://git.haproxy.org/git/haproxy-3.2.git/
Git Web browsing : https://git.haproxy.org/?p=haproxy-3.2.git
Changelog : https://www.haproxy.org/download/3.2/src/CHANGELOG
Dataplane API :
https://github.com/haproxytech/dataplaneapi/releases/latest
Pending bugs : https://www.haproxy.org/l/pending-bugs
Reviewed bugs : https://www.haproxy.org/l/reviewed-bugs
Code reports : https://www.haproxy.org/l/code-reports
Latest builds : https://www.haproxy.org/l/dev-packages
---
Complete changelog :
Alexander Stephan (1):
BUG/MINOR: sample: set SMP_F_CONST on srv_name fetch
Christopher Faulet (2):
BUG/MAJOR: htx: Don't swap buffers for empty HTX message with an error
BUG/MINOR: http-htx: Don't by-pass HTX API when merging cookie values
Frederic Lecaille (1):
BUG/MEDIUM: mux_quic: fix memory leak of rx app_buf on stream free
Huangbin Zhan (1):
BUG/MINOR: tools: fix invalid character detection in strl2ic()
Olivier Houchard (1):
BUG/MEDIUM: servers: Use a refcount for port_range and free it properly
--
Christopher Faulet
