Hi,
HAProxy 2.6.32 was released on 2026/07/29. It added 33 new commits
after version 2.6.31.
As for the 2.8.27, the announce is an expurgated copy-paste of the 3.4.3
announce:
* stats: Two issues about the stats page, reported by Red Hat/AISLE
Research, were fixed.
Proxies updated through the stats page while in "stats admin" mode were
not subject to the "stats scope" filtering, meaning a scope meant to
restrict which proxies are visible/actionable could be silently bypassed
on POST requests.
Separately, POST requests to the stats interface did not validate that the
Origin (or Referer) header matched the Host, which is now checked to
mitigate CSRF attacks.
* ssl-gencert: A memory leak on every certificate generation was fixed.
Two temporary buffers were not freed after generating a certificate on the
fly, leaking memory each time a new SNI triggered certificate
generation. This issue was reported by Red Hat/AISLE Research.
* sample/protobuf: buffer overflows after pointer-shift converters, reported
by Red Hat/AISLE Research and Charles Vosburgh, were fixed.
Several converters (protobuf/ungrpc field extraction, ltrim())
move the sample's data pointer forward on success but did not shrink the
sample's recorded buffer capacity accordingly. A converter chained
afterwards that relies on that capacity (e.g. padding via memset()) could
then write past the end of the buffer, leading to heap corruption or a
worker crash. All the affected converters now adjust the capacity
together with the pointer.
* protobuf: A nested-path validation bypass reported by Red Hat/AISLE
Research was fixed.
The protobuf field lookup used for the protobuf()/ungrpc() converters did
not strictly enforce hierarchical boundaries, so a flat sibling field
could incorrectly satisfy a nested-path lookup (e.g. matching a root-level
field as if it were nested under a parent). The lookup was rewritten as a
strict, non-recursive path walker that correctly bounds each nesting
level.
Separately, a crash because of deprecated protobuf group wire types was
fixed. These wire types are now explicitly rejected.
* http-fetch: Two crashes reachable from health-check configurations were
fixed.
"res.body"/"res.hdr"/... and similar response fetches assumed the
health-check receive buffer always held an HTX message, which is only true
for actual HTTP checks; on a plain TCP check, a hostile/misbehaving server
could craft the first bytes of its reply to be misinterpreted as HTX
internal fields, causing a wild read and worker crash (or leaking
arbitrary process memory).
Separately, "capture.req.hdr"/"capture.res.hdr" only validated the upper
bound of their index argument, so a negative capture id was accepted at
boot and dereferenced an out-of-bounds array entry at runtime, crashing
the worker on the very first request.
* slz: Several issues were fixed in the SLZ library.
A stream alternating many literals in the 144-255 range with cheap
back-references could keep inflating indefinitely instead of falling
back to a stored block, exceeding the library's documented worst-case
output size by several percent. A new accounting mechanism now bounds
this overhead. Practical impact on haproxy requires tune.bufsize above
~43 kB with the default reserve.
Five small correctness fixes inherited from upstream libslz were also
backported: Avoid reading up to a few bytes past the end of very short
inputs on architectures without fast unaligned access; stop appending an
extra, misplaced block to an already-finished deflate/gzip/zlib stream
(which could corrupt the trailing checksum in ~2% of fuzzed streams); fix
the Adler32 checksum accumulator sign handling on 32-bit systems
(affecting the zlib format only); avoid an undefined-behaviour signed left
shift when assembling input words byte by byte; and use the exact bit cost
when deciding whether to emit the last literals of a block as a stored
block, avoiding compressed output slightly larger than the documented
worst case.
* peers: A heap overflow when replicating large stick-table dictionary
entries was fixed.
peer_prepare_updatemsg() never verified that a stick-table entry's
dictionary value (e.g. server_key, up to ~16 kB) actually fit in the
update message being built. Since the peers protocol is plain-text and
unauthenticated, a rogue or compromised peer could plant an oversized
entry that overflows the 16 kB trash buffer as soon as the victim
replicates ("teaches") it, confirmed as a heap-buffer-overflow write. The
function now checks the available room before encoding and fails cleanly
if it doesn't fit. This was reported and fixes by Matt Suiche from Tolmo
Inc.
And, as usual, the bunch of minor fixes here and there, mainly raised during
AI-assisted code reviews. Most were never noticed:
* HTX API: Some bugs about how the HTX API was used were fixed here and
there.
* http-act: Double-frees and a couple of state bugs on parsing errors were
fixed.
* http-fetch/http-ana/http-htx: Few out-of-bounds reads were fixed.
* http-conv: The last input character could be lost when calling url-dec
converter, when the input buffer was full. This was fixed by failing the
converter in that case.
* mux-h1: An extra 200ms delay was observed on some H2-to-H1 messages
because the end of the message was not always properly detected. This
case is now properly handled.
* sample: An edge case in be2hex() was fixed.
Thanks everyone for your help on this release.
Please find the usual URLs below :
Site index : https://www.haproxy.org/
Documentation : https://docs.haproxy.org/
Wiki : https://github.com/haproxy/wiki/wiki
Discourse : https://discourse.haproxy.org/
Slack channel : https://slack.haproxy.org/
Issue tracker : https://github.com/haproxy/haproxy/issues
Sources : https://www.haproxy.org/download/2.6/src/
Git repository : https://git.haproxy.org/git/haproxy-2.6.git/
Git Web browsing : https://git.haproxy.org/?p=haproxy-2.6.git
Changelog : https://www.haproxy.org/download/2.6/src/CHANGELOG
Dataplane API :
https://github.com/haproxytech/dataplaneapi/releases/latest
Pending bugs : https://www.haproxy.org/l/pending-bugs
Reviewed bugs : https://www.haproxy.org/l/reviewed-bugs
Code reports : https://www.haproxy.org/l/code-reports
Latest builds : https://www.haproxy.org/l/dev-packages
---
Complete changelog :
Christopher Faulet (7):
BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size
BUG/MINOR: http-conv: Make url-dec failed if no space for trailing null
byte
BUG/MINOR: mux-h1: Don't delay send if message with c-l was fully sent
BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for
ltrim()
BUG/MEDIUM: http-fetch: don't parse a non-HTTP check buffer as an HTX
message
BUG/MINOR: htx: Perform raw copy for messages of same size in
htx_copy_msg()
BUG/MINOR: htx: Transfer HTX_FL_EOM flag on success in htx_append_msg()
Frederic Lecaille (2):
BUG/MEDIUM: protobuf: adjust sample size capacity after pointer shift
BUG/MEDIUM: protobuf: fix nested path bypass in field lookup
Matt Suiche (2):
BUG/MEDIUM: peers: check the available room before encoding dict values
BUG/MEDIUM: sample: reject the deprecated protobuf group wire types
Olivier Houchard (3):
BUG/MEDIUM: stats: Ensure that Origin is valid on POSTs
DOC: stats: Document that stats admin is vulnerable to a CSRF attack
BUG/MEDIUM: ssl-gencert: Don't forget to free memory when done
Willy Tarreau (19):
MINOR: stats: factor the proxy vs scope check into its own function
BUG/MEDIUM: stats: subject "stats admin" accesses to "stats scope"
filtering
BUG/MINOR: http-htx: fix the length moved when removing a header value
BUG/MEDIUM: http-fetch: reject a negative capture id in
capture.{req,res}.hdr
BUG/MINOR: http-htx: check the trash allocation in
http_scheme_based_normalize()
BUG/MINOR: h2: don't use a block pointer to roll back a partial HTX
conversion
BUG/MINOR: http-ana: fix a one-byte over-read in the client-side cookie
parser
BUG/MINOR: http-act: fix a double free of the regex on a rule parsing
error
BUG/MINOR: http-act: fix a double free of the map reference on a parsing
error
BUG/MINOR: http-act: restore the response buffer state in the early-hint
action
BUG/MINOR: http-act: reject a negative capture id in the capture actions
BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply
argument
BUG/MINOR: slz: do not read past the end of the input around the match
loop
BUG/MINOR: slz: use the exact switch cost for the last literals of a block
BUG/MEDIUM: slz: bound the bits wasted by the 9-bit literals
BUG/MINOR: slz: do not append a block to an already finished stream
BUG/MINOR: slz: fix the adler32 accumulators signedness on 32-bit
BUG/MINOR: slz: avoid undefined shifts when building the word byte by byte
CLEANUP: slz: clarify that the size promise applies to the stream, not to
a call
--
Christopher Faulet
