Hi,
HAProxy 2.8.29 was released on 2026/09/24. It added 49 new commits
after version 2.8.28.
This release fixes a number of bugs in the HTTP/3 and QUIC stacks, in the
HTTP message processing and in the Lua integration, along with several
smaller fixes and a startup failure when configuring "maxpipes" without
"maxconn".
* h3: Truncated HTTP/3 frames are now rejected.
HTTP/3 connections are now rejected when a stream ends before all the
bytes announced in a frame have arrived. Previously, an incomplete frame
could be accepted, creating a risk of request-content smuggling when the
request was forwarded. This is an important fix for deployments accepting
HTTP/3 traffic. This issue was repported by Rajat Raghav.
In relation to this issue, HTTP/1 connection reuse was hardened: a
connection on which the message body was not fully sent is now closed
instead of being reused, whether the body was announced with a
Content-Length or chunked. This prevents a subsequent message from being
sent on a connection where the peer is still waiting for the missing data.
* quic: Connection and stream leaks on QUIC frontends were fixed.
Two issues could prevent QUIC connections from being properly released.
A client sending a RESET_STREAM frame as the very first frame of a stream
left that stream half-closed and accounted forever: stream instances
accumulated in memory for the whole lifetime of the connection, and the
connection itself could refuse to close even after the idle timeout had
expired. Such streams are now closed and purged immediately.
Second, the connection timeout was only armed once the first bytes were
received, so a connection on which nothing was ever received had no
timeout at all and could linger indefinitely. "timeout client" is now
armed from connection initialization, which guarantees that idle
connections are always closed as expected, and further reduces the risk of
leaked connections, including the case above.
* h3/qpack: Several stalled transfers and compliance issues were fixed.
A transfer ending with an empty DATA frame, empty trailers, or an unknown
extension frame could wait until timeout instead of completing. These
cases now correctly signal the end of the message. Invalid empty headers
are also handled according to the protocol.
HTTP/3 header-compression control streams now release the space occupied
by data already processed, rather than becoming permanently stalled.
Invalid references to an unsupported dynamic compression table are also
rejected more strictly. Finally, HTTP/3 frame counters no longer count a
large frame several times just because it arrived in multiple pieces,
making the reported statistics more reliable.
* quic: More robust key updates and error recovery.
A failed memory allocation during a key update could cause a worker crash
on a subsequent key-phase change. HAProxy now retries key preparation and,
if necessary, drops the packet so that the peer can retransmit it, rather
than using missing keys. Delayed packets from the initial key phase are
also accepted correctly after the first key update, avoiding unnecessary
packet loss and retransmissions on connections with reordered traffic.
Error handling after the handshake now cleans up the correct connection
identifiers and preserves their numbering for a retry. Additional
defensive handling of QUIC encryption contexts is included as a
precaution; its problematic cleanup path is not currently reachable. The
backport was also adjusted to keep QUIC builds working with AWS-LC, since
this branch does not include the newer ChaCha20 support for that
library. This does not add support for any new cipher.
* htx: Header length limits are now enforced on updates.
A header name is limited to 255 bytes and a header value to 1 MB minus one
byte. These limits were checked when a header was added, but not when an
existing one was rewritten with "replace-header" or "replace-value"
rules. When exceeded, the length silently overflowed into the block type,
corrupting the message. Since the header must first fit in a buffer, only
setups with "tune.bufsize" above 1 MB are affected; a client sending a
large enough header is then enough to trigger the issue. The same checks
are now applied on updates. The issue was reported by Adam Crawford.
An additional HTTP message buffer fix was backported as a precaution, to
prevent corruption when adding an empty block to a full buffer. Its only
known trigger is the decompression filter which only exists in 3.5-dev, so
no released version is known to be affected.
* hlua: A use-after-free in Lua cosockets was fixed.
Garbage collection of Lua sockets could release resources from the wrong
thread or access resources already freed, potentially crashing a worker.
This notably affected scripts loaded with "lua-load", whose state is
shared between threads. Socket cleanup is now handed back to the owning
thread. Closing a Lua socket that was never connected is also safe.
HTTP message duplication consistently returns nil when there is no data to
copy. Finally, memory associated with Lua rules is released during
configuration teardown; this was not a leak accumulating on each request
during normal operation.
* ssl: TLS session resumption failures and several smaller issues were fixed.
With OpenSSL 3.1 or older, resuming a TLS session at the end of its
configured lifetime could fail with an internal-error alert instead of
falling back to a full handshake. Expired sessions are now discarded
correctly, allowing the connection to proceed with a fresh handshake while
still respecting "tune.ssl.lifetime". Newer OpenSSL versions were not
affected.
On 64-bit big-endian systems such as s390x and ppc64, the AES-GCM
converters could corrupt memory and crash a worker when processing input.
The output-length handling has been corrected. This particular issue does
not affect the usual little-endian systems.
A small memory leak when deleting CA-file entries has also been fixed.
* sample: Strings carrying an embedded NUL byte could bypass ACLs.
The "url_dec", "json_query", "jwt_header_query" and "jwt_payload_query"
converters could produce a string containing a NUL byte (from "%00",
"\u0000" or a base64-decoded JSON). Such a string was then compared by "-m
str" on its prefix only, so "/public%00/admin" matched "/public" and an
allow-list could be bypassed. These converters now fail on such input,
like they already do on invalid sequences. Legitimate URLs and tokens are
not affected. Along with this, the configuration manual now describes the
exact contents allowed for each sample type.
* map: A crash with map_regm inside an ACL was fixed.
Using the "map_regm" converter in an ACL applied on a fetch that iterates
over several values, such as "req.hdr(name)" without an occurrence number,
crashed the process as soon as the first value did not match. The
converter was overwriting the internal iteration cursor of the fetch. A
single request was enough to trigger it, and the bug has existed since
1.7. The issue was reported by @Michael-JRead.
* http rules: capture rules evaluated in the backend context could crash.
Capture rules cannot be used on the backend side. However it is possible
to have such rules on a listener. In that case, when the listener was used
as a backend only, a crash could be experienced or the memory pools could
be corrupted because the capture slots were used in the context of a
frontend that never referenced them. Since such backend relationship can
only be resolved at run time, this could not be detected at startup. The
rules are now ignored for requests coming from another frontend, and the
documentation was updated to state that these capture slots only exist in
the section declaring them.
* http-htx: Rewriting the "Host" header of large requests could corrupt them.
When a "replace-header" rule rewrites the "Host" header of a request whose
URI contains an authority (all HTTP/2 and HTTP/3 requests, and HTTP/1
requests in absolute form), the URI's authority is updated to stay in sync
with the new value. This update was performed using on of rotating trash
chunk and could overwrite the new host value iteself, corrupting this way
the request. The authority update is now performed in a dedicated buffer,
so the forwarded request always remains consistent.
* http rules: Conditional "normalize-uri" rules could apply the wrong
normalizer.
When "percent-to-uppercase", "percent-decode-unreserved" or
"path-strip-dotdot" was used without its optional argument and directly
followed by an "if"/"unless" condition, the rule silently ended up as
"path-merge-slashes". Such rules now perform the configured
normalization. If you use them, be aware that URIs will now be rewritten
as intended, while they were previously left mostly untouched. The issue
was fixed by Youngkwang Lee.
* mux-h2: HTTP/2 health checks could stall during connection setup.
An H2 stream that only subscribed for sending without actually trying to
send data was never woken up again. This could happen with health checks
using the PROXY protocol on H2 connections when the handshake was not yet
complete, leaving the check stuck until its timeout. These checks now
resume correctly once the connection is ready.
* task: A race in the destruction of shared tasks was fixed.
Destroying a task that could still be scheduled by another thread could
lead to the task being run after being freed, with a risk of crash. Such
tasks are now killed asynchronously instead, avoiding this race on
multithreaded deployments.
* limits: Configuring "maxpipes" without "maxconn" could prevent startup.
Setting "maxpipes" while leaving "maxconn" to be calculated automatically
could make HAProxy refuse to start: the connection limit was calculated
without reserving the file descriptors needed for the configured pipes,
then rejected by the final resource checks. HAProxy now accounts for
"maxpipes" when sizing the connection limit, allowing such configurations
to start with a "maxconn" suited to the available file descriptors. There
is no longer a need to set "maxconn" explicitly to work around this issue.
Other few minor issues were also addressed:
* TLS inspection: SNI extraction was fixed to respect the extension's
boundaries.
* http fetch: "http_auth_bearer" used with a custom header was fixes to
work as expected in all cases
* http analysis: The tunnel timeout was not applied on streasms with
data filters, this was fixed. In addition, two issues with 1xx interim
responses were fixed. The transaction status code after early hints is
now properly restored to properly deal with internal responses, such
as deny rules. And processing of 1xx interim responses in H2 was fixed
to not truncate the final responses with no known length. Finally, the
"http_fail_cnt" counter was wrongly incremented on error during
response forwarding. Only actual server failures are now counted, once
each.
* debug: Crashes while dumping streams were fixed.
* resolvers: Truncated DNS responses were misclassified. These responses
are now classified correctly, making DNS failures easier to diagnose.
* log: Invalid logging configurations could crash configuration
parsing. xThis was fixed by Kirill Furman.
* checks: HTTP health checks with several "host" headers could get
corrupted because an outdated request-line could be used. It is now
refreshed after each update.
Thanks to everyone for your help on this release!
Please find the usual URLs below :
Site index : https://www.haproxy.org/
Documentation : https://docs.haproxy.org/
Wiki : https://github.com/haproxy/wiki/wiki
Discourse : https://discourse.haproxy.org/
Slack channel : https://slack.haproxy.org/
Issue tracker : https://github.com/haproxy/haproxy/issues
Q&A from devs : https://github.com/orgs/haproxy/discussions
Sources : https://www.haproxy.org/download/2.8/src/
Git repository : https://git.haproxy.org/git/haproxy-2.8.git/
Git Web browsing : https://git.haproxy.org/?p=haproxy-2.8.git
Changelog : https://www.haproxy.org/download/2.8/src/CHANGELOG
Dataplane API :
https://github.com/haproxytech/dataplaneapi/releases/latest
Pending bugs : https://www.haproxy.org/l/pending-bugs
Reviewed bugs : https://www.haproxy.org/l/reviewed-bugs
Code reports : https://www.haproxy.org/l/code-reports
Latest builds : https://www.haproxy.org/l/dev-packages
---
Complete changelog :
Amaury Denoyelle (7):
BUG/MEDIUM: h3: do not block FIN on empty DATA frame
BUG/MINOR: h3: handle empty HEADERS frame as specified
BUG/MINOR: h3: only increment frame type counter on new header
BUG/MAJOR: h3: reject H3 truncated frames
BUG/MINOR: h3: handle unknown frame type on request stream as specified
BUG/MAJOR: mux_quic: fix leak on RESET_STREAM reception
BUG/MEDIUM: mux_quic: activate timeout on FE init
Christopher Faulet (18):
BUG/MEDIUM: hlua: Never release a cosocket applet from the GC
BUG/MINOR: hlua: Always return nil if there is no data to dup for HTTP
messages
BUG/MEDIUM: htx: Reserve a block descriptor for zero-sized blocks
BUILD: quic: Don't check ChaCha20 header context for AWS-LC
BUG/MINOR: tools: Don't try to anonymize a NULL string
BUG/MAJOR: htx: Check the header/trailer length limits when one is updated
BUG/MINOR: h3: Fix a misplaced closing brace because of a bad backport
BUILD: h3: Fix a possible uninitialized value
BUG/MINOR: http-client: Convert server timeout ticks when setting it
BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses
BUG/MEDIUM: http-htx: don't build the new authority in a rotating trash
chunk
BUG/MEDIUM: http-act: ignore "capture len" rules evaluated from a backend
BUG/MEDIUM: tcp-rules: ignore "capture len" rules evaluated from a backend
BUG/MINOR: http-ana: count response body failures only once in
http_fail_cnt
BUG/MINOR: http-fetch: http_auth_bearer() must not match a missing header
BUG/MINOR: http-fetch: fix the space check of http_auth_bearer(<hdr>)
BUG/MINOR: tcpcheck: refresh the start-line after updating the authority
BUG/MINOR: http-ana: restore the transaction status after early hints
Frederic Lecaille (10):
BUG/MEDIUM: quic: crash on key update phase change after a failed one
BUG/MINOR: quic: late packets of the first key phase are dropped
MINOR: quic: protect the ChaCha20 header protection context from being
freed
BUG/MINOR: qpack: encoder and decoder stream data is never consumed
BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached
BUG/MINOR: quic: delete the wrong CIDs when post-handshake frames fail
BUG/MEDIUM: map: do not overwrite the fetch context in pat_match_regm()
REGTESTS: map: check map_regm inside an ACL over an iterating fetch
BUG/MINOR: sample: reject a \0 byte in url_dec, json_query and jwt_*_query
REGTESTS: http-rules: check "-m str" on a sample with an embedded \0
Kirill Furman (1):
BUG/MINOR: log: fix double-free error when error in parse_loger occurs
M9nx (1):
BUG/MINOR: hlua: release private Lua rule data on teardown
Manu Nicolas (2):
BUG/MINOR: resolvers: classify empty truncated responses
BUG/MEDIUM: http-ana: apply tunnel timeout with data filters
Olivier Houchard (3):
MEDIUM: mux-h1: Harden test for short data at end of stream
BUG/MEDIUM: mux-h2: Make sure we remove H2_SF_NOTIFIED on subscribe
BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy
Remi Tricot-Le Breton (2):
BUG/MINOR: ssl: don't pass the address of a size_t as an int* to OpenSSL
BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry
William Lallemand (2):
BUG/MINOR: payload: bound ClientHello extension lists by the extension
length
BUG/MEDIUM: ssl: don't set a 0 timeout on an expired TLS session
Willy Tarreau (2):
DOC: configuration: clarify the validity ranges of sample types
BUG/MEDIUM: limits: properly account for global.maxpipes in
compute_ideal_maxconn()
Youngkwang Lee (1):
BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a
condition
--
Christopher Faulet
