Proposed minimal Jammy fix, built and tested on top of
2.4.30-0ubuntu0.22.04.3:
if (!ret && !ofs && b_size(srcbuf) &&
!buf_room_for_htx_data(srcbuf)) {
The attached patch requires an allocated source buffer before treating
lack of HTX room as an oversized chunk-size line. In HAProxy 2.4 an
empty buffer can be released while waiting for the next line. Its zero
size also makes buf_room_for_htx_data() return zero, which the unadapted
backport incorrectly treats as a full buffer. This guard preserves the
oversized-line rejection for a real allocated buffer. It does not revert
CVE-2026-110354, CVE-2026-110353, or any other .3 security patch.
Executed comparison in disposable Ubuntu 22.04 amd64 containers, using
identical configurations and localhost synthetic backends:
official .2 official .3 .3 + guard
Valid response/body checks 200/200 60/200 200/200
Protocol/security checks 10/28 26/28 28/28
Original published reproducer 10/10 0/10 10/10
The original reproducer from comment #1 is unchanged: the corrected
binary returns HTTP 200 with the complete 426-byte body in all 10
checks; official .3 returns 502 in all 10.
Additional cases cover split chunk-size digits and CRLF, final chunks,
trailers, chunk extensions, empty bodies, 64-KiB streams, content-length
and close-delimited responses, valid chunked uploads, and one/two
threads. The 28 protocol checks include oversized request/response
chunk-size lines and extensions at 1024/16384-byte buffer sizes,
subsequent chunks, recovery, and initial/subsequent H2 prefaces. The
candidate returns 400 promptly for oversized requests; malformed
responses return 502 before headers are forwarded or abort the
incomplete stream promptly afterward. All rejection checks retain a
1.5-second bound against 3-second proxy timeouts. Fragmented H2 prefaces
after an H1 transaction return 400, while legitimate initial H2 upgrades
continue to work.
A separate read-only comparison against the affected application's
existing three backend nodes gave 30/30 expected responses for .2, 1/30
for .3, and 30/30 for the candidate. No production listener, package or
routing was changed for these tests.
Independent source reconstruction confirms the guard is the sole change
in h1_htx.c; mux_h1.c, all 13 packaged configuration/service files, and
compiled feature flags match official .3. The local unsigned candidate
is 2.4.30-0ubuntu0.22.04.3+lp2172897.1. This is a proposed fix for
maintainer review, not an official update; the full upstream
regression/fuzz suite was not run, and the candidate has not been
installed in production.
Please review this adaptation for a corrected Jammy security update. A
companion source/test bundle contains the localhost harness, original
reproducer, runner and executed synthetic results, without private
deployment details.
Patch SHA256:
714240f9fdde04d68c733c76a3eddc08a66d579d71a8dda93aeae890e1e13a40
** CVE added: https://cve.org/CVERecord?id=CVE-2026-110353
** CVE added: https://cve.org/CVERecord?id=CVE-2026-110354
** Patch added: "Proposed LP #2172897 Jammy allocated-buffer fix"
https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897/+attachment/6014781/+files/lp2172897-allocated-chunk-buffer.patch
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172897
Title:
haproxy 2.4.30-0ubuntu0.22.04.3: CVE-2026-110354 backport causes
intermittent 502 (PH) on valid chunked responses
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
