Public bug reported: A new release of haproxy is available for merging from Debian.
Ubuntu: 3.4.2-1ubuntu4 Debian Experimental: 3.4.7-1 Debian Unstable: 3.2.26-1 ### New Debian Changes ### haproxy (3.4.7-1) experimental; urgency=medium * New upstream release. -- Vincent Bernat <[email protected]> Wed, 14 Oct 2026 22:05:05 +0200 haproxy (3.4.6-1) experimental; urgency=medium * New upstream release. -- Vincent Bernat <[email protected]> Mon, 28 Sep 2026 21:02:18 +0200 haproxy (3.4.4-1) experimental; urgency=medium * New upstream release. -- Vincent Bernat <[email protected]> Fri, 28 Aug 2026 21:58:08 +0200 haproxy (3.4.3-1) experimental; urgency=medium * New upstream release. -- Vincent Bernat <[email protected]> Wed, 29 Jul 2026 21:58:53 +0200 ### Old Ubuntu Delta ### haproxy (3.4.2-1ubuntu4) stonking; urgency=medium * SECURITY UPDATE: request content smuggling - debian/patches/CVE-2026-90678.patch: BUG/MAJOR: h3: reject H3 truncated frames in src/h3.c. - CVE-2026-90678 -- Marc Deslauriers <[email protected]> Fri, 18 Sep 2026 13:25:52 -0400 haproxy (3.4.2-1ubuntu3) stonking; urgency=medium * Transition to lua5.5 (LP: #2155757) -- Mitchell Augustin <[email protected]> Fri, 31 Jul 2026 09:48:33 -0500 haproxy (3.4.2-1ubuntu2) stonking; urgency=medium * No-change rebuild against libssl4 -- Ravi Kant Sharma <[email protected]> Fri, 24 Jul 2026 10:37:04 +0000 haproxy (3.4.2-1ubuntu1) stonking; urgency=medium * Merge with Debian experimental (LP: #2153162) (LP: #2154936). Remaining changes: - d/{control,rules}: Remove support for OpenTracing due to it being in universe * Dropped changes: - d/p/CVE-2026-26080.patch: check for return value in src/quic_frame.c. [CVE-2026-26080] [ Included in upstream version 3.4.0 ] - d/p/CVE-2026-26081.patch: reject invalid token in src/quic_token.c. [CVE-2026-26081] [ Included in upstream version 3.4.0 ] - Fix crash in HTTP/3 CONNECT + debian/patches/quic-fix-1.patch: revert BUG_ON if sending on locally closed QCS in include/haproxy/qmux_http.h, src/mux_quic.c, src/qmux_http.c. + debian/patches/quic-fix-2.patch: reject frontend CONNECT as currently not implemented in src/h3.c. [ Included in upstream version 3.4.0 ] - d/p/CVE-2026-33555.patch: check body size with content-length on empty FIN in src/h3.c. [CVE-2026-33555] [ Included in upstream version 3.4.0 ] - d/p/CVE-2026-55203.patch: mux-fcgi: fix uint16_t overflow in drl += drp in src/mux_fcgi.c. [CVE-2026-55203] [ Included in upstream version 3.4.1 ] - d/p/CVE-2026-55204.patch: hpack-tbl: add missing NULL check after hpack_dht_defrag() in src/hpack-tbl.c. [CVE-2026-55204] [ Included in upstream version 3.4.1 ] -- Renan Rodrigo <[email protected]> Thu, 09 Jul 2026 22:27:40 -0300 ** Affects: haproxy (Ubuntu) Importance: Wishlist Status: New ** Tags: needs-merge upgrade-software-version ** Changed in: haproxy (Ubuntu) Importance: Undecided => Wishlist ** Changed in: haproxy (Ubuntu) Milestone: None => ubuntu-27.01 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171128 Title: Merge haproxy 3.4.7-1 from Debian for tenacious cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2171128/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
