Independent confirmation with an executed minimal reproducer on Ubuntu 22.04 amd64:
* haproxy 2.4.30-0ubuntu0.22.04.2: 10/10 HTTP 200, with all expected 426-byte response bodies intact. * haproxy 2.4.30-0ubuntu0.22.04.3: 10/10 HTTP 502, with the standard 107-byte HAProxy error body. Both binaries used the identical minimal HTTP-mode configuration (one thread) and the same synthetic localhost backend in a disposable official ubuntu:22.04 container. There is no TLS, Nginx, application framework, or production dependency in this test. The backend sends a valid HTTP/1.1 response with Transfer-Encoding: chunked. Its body is 426 ASCII 'a' bytes, framed as "1aa\r\n" + body + "\r\n", followed by "0\r\n\r\n". Headers, the complete data chunk, and the terminator are sent in separate writes with 30 ms delays. Expected behavior is HTTP 200 with the complete body for both versions. The attached archive contains: - reproduce.py: standard-library Python backend and comparison harness. - reproduce-in-docker.sh: disposable Ubuntu 22.04 runner that installs exact .3 and extracts exact .2 for comparison. - maintainer-evidence.json: sanitized results and environment details. - maintainer-report.md: minimal configuration, further observations, and source references. To run, extract the archive and execute: bash reproduce-in-docker.sh Alternatively, with both binaries and dependencies available: python3 reproduce.py /path/to/haproxy-previous /path/to/haproxy-updated The container publishes no ports, and the backend and proxies listen only on 127.0.0.1 inside it. The runner requires the exact packages to remain available from the Ubuntu archives. On the affected deployment, the error snapshot was MSG_CHUNK_SIZE(26), input len 0, error position 0, reported 16384 free, body len 426, with PH-- termination. Downgrading only HAProxy to .2 restored the expected responses without changing the configuration. The reproducer confirms a package regression; we have not bisected the individual security patches. Archive SHA256: 5527a9c95ac991554d8fcdc35ef8e13a55082f737c86d283d6007e2e262c3ab8 Please use this reproducer to validate a corrected Jammy security update that retains the intended fixes. ** Attachment added: "Deterministic Jammy HAProxy .2 vs .3 reproducer, test results, and report" https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897/+attachment/6014776/+files/haproxy-jammy-regression-report.tar.gz -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172897 Title: haproxy 2.4.30-0ubuntu0.22.04.3: CVE-2026-110354 backport causes intermittent 502 (PH) on valid chunked responses To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
