Public bug reported:
On our Ubuntu 22.04 servers HAProxy got updated via the unattended security
updates to version 2.4.30-0ubuntu0.22.04.3.
This caused most of our servers to be unreachable.
HAProxy displayed 502 errors for most of our backends.
Downgrading to 2.4.30-0ubuntu0.22.04.2 made the problem go away.
The analysis that follows now was done with the help of an LLM, I can only say
for sure that downgrading the package fixed it.
However I'm happy to provide any additional information or logs (on a private
channel).
--- LLM Generated ---
Environment
- Ubuntu 22.04 (jammy), two HAProxy hosts, both affected
- haproxy 2.4.30-0ubuntu0.22.04.3, installed by unattended-upgrades
- HTTP mode, frontend with "alpn h2,http/1.1", default tune.bufsize (16384)
- Backends: nginx with PHP applications (HTTP/1.1, plain HTTP on port 80), plus
one backend over TLS ("ssl verify none")
What happened
Total events captured on [04/Nov/2026:07:13:02.080] : 62614
Every backend entry shows the same signature: state MSG_CHUNK_SIZE, with an
empty buffer.
Three examples (client IPs and server names masked):
[04/Nov/2026:07:12:58.031] backend password_safe (#16): invalid response
frontend default (#3), server backend1 (#1), event #62497, src x.x.x.x:53977
buffer starts at 0 (including 0 out), 16384 free,
len 0, wraps at 0, error at position 0
H1 connection flags 0x80002200, H1 stream flags 0x00004810
H1 msg state MSG_CHUNK_SIZE(26), H1 msg flags 0x00001756
H1 chunk len 0 bytes, H1 body len 0 bytes :
[04/Nov/2026:07:08:30.193] backend drupal_production (#8): invalid response
frontend default (#3), server backend2 (#1), event #54538, src x.x.x.x:59006
buffer starts at 0 (including 0 out), 16384 free,
len 0, wraps at 0, error at position 0
H1 connection flags 0x80002200, H1 stream flags 0x00004890
H1 msg state MSG_CHUNK_SIZE(26), H1 msg flags 0x00001756
H1 chunk len 0 bytes, H1 body len 2162 bytes :
[04/Nov/2026:07:13:01.986] backend highsystem (#12): invalid response
frontend default (#3), server backend3 (#1), event #62613, src x.x.x.x:50018
buffer starts at 0 (including 0 out), 16384 free,
len 0, wraps at 0, error at position 0
H1 connection flags 0x80002200, H1 stream flags 0x00004810
H1 msg state MSG_CHUNK_SIZE(26), H1 msg flags 0x00001716
H1 chunk len 0 bytes, H1 body len 391 bytes :
Analysis
The .3 package contains the fix for CVE-2026-110354
(debian/patches/CVE-2026-110354.patch, src/h1_htx.c).
Upstream (2.6 commit 68609955873ff845220b7a7cf22147d3617a0b42, "BUG/MAJOR:
h1-htx: report an error on a too long chunk-size line") sets a parse error in
h1_parse_msg_data only when all of these are true:
1. nothing was parsed,
2. the parser is in the chunk-size state,
3. the input buffer is full.
In every captured error, conditions 1 and 2 match, but the buffer is empty
("len 0", "16384 free").
Condition 3 is not true, but the error fires anyway.
Our conclusion is that the "buffer is full" condition does not work correctly
in the 2.4 backport.
As a result, any chunked response fails when the next chunk-size line has not
arrived yet.
This happens in the normal case, when a backend streams its output.
Example 1 fails before any body byte.
Example 2 fails after 2162 body bytes, so later chunks are affected too, not
only the first one.
Example 3 is a TLS backend, so the backend transport makes no difference.
There is no upstream 2.4 commit for this fix, because 2.4 is EOL.
The upstream commit message also says that 2.6 and 2.8 cannot hit the original
loop.
We did not inspect the Ubuntu patch itself.
What we tested
- dpkg.log: the upgrade from .2 to .3 happened at 03:26, and the first 502s
appeared after it.
- "show errors" on the admin socket: all backend errors are "invalid response"
in MSG_CHUNK_SIZE with an empty buffer (see above).
- Response headers, checked directly against the backends:
- an affected backend (PHP application): "Transfer-Encoding: chunked"
- an unaffected backend: "Content-Length: 54"
Only backends that send chunked responses appear in "show errors".
- The client network made no difference: internal and external clients failed
on the same backends.
- Downgrade: apt install haproxy=2.4.30-0ubuntu0.22.04.2 on both hosts. The
502s stopped at once. Both hosts now hold haproxy at .2.
** Affects: haproxy (Ubuntu)
Importance: Undecided
Status: Invalid
** Tags: jammy
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172911
Title:
HAProxy 2.4.30-0ubuntu0.22.04.3 rejects truncated resposens
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172911/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
