*** This bug is a duplicate of bug 2172897 ***
https://bugs.launchpad.net/bugs/2172897
Same regression here (jammy, haproxy 2.4.30-0ubuntu0.22.04.3, installed
by unattended-upgrades). Downgrading to 2.4.30-0ubuntu0.22.04.2 fixes it
with the same config. I narrowed it down:
Trigger: the backend pauses between two chunks. When the HAProxy buffer
is empty at the start of a chunk-size line, .3 flags the response as
invalid instead of waiting for more data. tune.bufsize makes no
difference (16384 and 100000 behave the same). Replaying the same bytes
with no pause does NOT trigger it.
`show errors` on .3:
backend b (#3): invalid response
buffer starts at 0 (including 0 out), 16384 free,
len 0, wraps at 0, error at position 0
H1 msg state MSG_CHUNK_SIZE(26), H1 msg flags 0x00001736
H1 chunk len 0 bytes, H1 body len 48586 bytes
Symptoms: a truncated 200 if headers were already forwarded (e.g. Apache
mod_deflate gzip assets cut after the first burst), otherwise a 502 with
termination state PH.
This points at debian/patches/CVE-2026-110354.patch (h1-htx: "too long
chunk-size line").
Self-contained reproducer:
--- chunked_backend.py
import socket, time
s = socket.socket(); s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind(("127.0.0.1", 18080)); s.listen(8)
while True:
c, _ = s.accept()
try:
c.recv(65536)
c.sendall(b"HTTP/1.1 200 OK\r\nTransfer-Encoding:
chunked\r\nConnection: close\r\n\r\n")
for _ in range(5):
c.sendall(b"%x\r\n" % 8096 + b"A" * 8096 + b"\r\n")
time.sleep(0.2)
c.sendall(b"0\r\n\r\n")
except OSError as e:
print("backend: client aborted:", e)
finally:
c.close()
--- test.cfg
global
tune.bufsize 16384
defaults
mode http
option http-server-close
timeout connect 10s
timeout client 1m
timeout server 1m
frontend f
bind 127.0.0.1:18016
default_backend b
backend b
server s1 127.0.0.1:18080
--- run
python3 chunked_backend.py &
haproxy -f test.cfg &
curl -s -o /dev/null -w '%{http_code} %{size_download}\n'
http://127.0.0.1:18016/
Results:
2.4.30-0ubuntu0.22.04.3 -> 502 107 (backend: Connection reset by peer)
2.4.30-0ubuntu0.22.04.2 -> 200 40480
** CVE added: https://cve.org/CVERecord?id=CVE-2026-110354
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172907
Title:
Regression in Ubuntu 22.04 HAProxy security update: HTTP/1.1 chunked
responses cause 502 Bad Gateway
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172907/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
