Public bug reported:
# Regression in Ubuntu 22.04 HAProxy security update: HTTP/1.1 chunked
responses cause 502 Bad Gateway
**Package:** haproxy
**Ubuntu release:** 22.04 LTS (Jammy)
**Working package:** 2.4.30-0ubuntu0.22.04.2
**Affected package:** 2.4.30-0ubuntu0.22.04.3
**Related security notice:** USN-8972-1
**Suggested tag:** regression-update
## Summary
After upgrading HAProxy from package revision .2 to .3 on 4 November
2026, multiple production ASP.NET Core applications (.NET 8, 9 and 10)
began returning HTTP 502 Bad Gateway through HAProxy.
Older ASP.NET Framework applications remained functional.
The issue was reproducible using a minimal HAProxy configuration,
independently of our production configuration.
Downgrading to package revision .2 resolved the problem immediately.
## Reproduction results
The same IIS application, backend address, TLS certificate and minimal
HAProxy configuration were tested with both package versions.
| Test | Revision .2 | Revision .3 |
|---|---|---|
| HTTP/1.1 through HAProxy | 200 OK | 502 Bad Gateway |
| HTTP/1.0 through HAProxy | 200 OK | 200 OK |
| Direct HTTP/1.1 to IIS | 200 OK | 200 OK |
When accessed directly over HTTP/1.1, the IIS application returns:
- HTTP/1.1 200 OK
- Transfer-Encoding: chunked
The direct curl request completes successfully with exit code 0.
When accessed using HTTP/1.0, the backend returns HTTP/1.1 200 OK with
Connection: close and without Transfer-Encoding: chunked.
## HAProxy diagnostics
The HAProxy runtime reports:
backend dynqr_cavvisit: invalid response
H1 msg state MSG_CHUNK_SIZE(26)
H1 chunk len 0 bytes
Other unrelated ASP.NET Core application backends exhibit similar
errors.
Backend health checks remain UP / L4OK despite the HTTP failures.
## Minimal reproduction configuration
global
maxconn 100
defaults
mode http
timeout connect 5s
timeout client 15s
timeout server 15s
frontend test
bind 127.0.0.1:18443 ssl crt /path/to/test-cert.pem
http-request set-header X-Forwarded-Proto https
default_backend test_backend
backend test_backend
option http-server-close
server app <IIS_BACKEND_IP>:8256 check
Identical configurations were launched as independent HAProxy instances
using binaries extracted from the two Ubuntu packages.
**Result with .3:**
HTTP/1.1: 502
HTTP/1.0: 200
**Result with .2:**
HTTP/1.1: 200
HTTP/1.0: 200
No production configuration changes were required to reproduce the
problem.
## Timeline
- 2026-11-04 06:41:04 UTC: HAProxy upgraded automatically from .2 to .3.
- Multiple ASP.NET Core services subsequently experienced HTTP 502 errors.
- The issue was reproduced independently on a secondary HAProxy node.
- Both production HAProxy nodes were rolled back to .2.
- HTTP/1.1 requests returned 200 again after rollback.
## Expected behavior
HAProxy should process valid HTTP/1.1 chunked responses from ASP.NET
Core / IIS without returning HTTP 502.
## Actual behavior
Package revision .3 rejects these responses with an HTTP parsing error
in MSG_CHUNK_SIZE, while revision .2 processes the same backend
responses successfully.
## Operational impact
The regression caused a production outage affecting multiple application
endpoints.
We have temporarily pinned HAProxy to revision .2 to restore service,
but this is not an acceptable permanent solution because revision .3
contains security fixes.
## Request
Could the Ubuntu Security Team investigate whether the CVE-2026-110354
HTTP/1.1 parser fix or its backport to HAProxy 2.4.30 introduced a
response-parsing regression?
We would appreciate:
1. Confirmation of the root cause.
2. Any safe configuration workaround.
3. A corrected Ubuntu 22.04 security package.
We can provide sanitized runtime logs and additional reproducible test
results if needed.
** Affects: haproxy (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172907
Title:
Regression in Ubuntu 22.04 HAProxy security update: HTTP/1.1 chunked
responses cause 502 Bad Gateway
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172907/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
