Confirming this on Ubuntu 22.04 (jammy), haproxy 2.4.30-0ubuntu0.22.04.3, this time with Tomcat 9 backends (JSF/PrimeFaces application).
Symptoms are intermittent (roughly 0.3% of requests, at least). They started about 15 minutes after the package was upgraded and are still happening: - 502 with termination flags PH, and - 200 followed by a truncated body: the browser reports net::ERR_INCOMPLETE_CHUNKED_ENCODING. The affected requests are POST responses that Tomcat sends with Transfer-Encoding: chunked. "show errors" shows the same signature as in the original report, always with an empty buffer: invalid response, H1 msg state MSG_CHUNK_SIZE(26), len 0, error at position 0, H1 body len 8552 bytes Unlike with Node/Express, "compression offload" does not help here: the chunked encoding is not caused by compression (the backend already has it and the errors continue). I have not found a configuration workaround that keeps the proxy in HTTP mode. The only remedy that works is reverting to 2.4.30-0ubuntu0.22.04.2: apt-get install --allow-downgrades haproxy=2.4.30-0ubuntu0.22.04.2 && apt-mark hold haproxy After the downgrade: [N] errors in [T] (before: roughly 15 per hour). This leaves jammy users choosing between the CVE-2026-110353/110354 fixes and working chunked responses. A corrected update would be much appreciated. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172897 Title: haproxy 2.4.30-0ubuntu0.22.04.3: CVE-2026-110354 backport causes intermittent 502 (PH) on valid chunked responses To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
