[ubuntu/noble-security] haproxy 2.8.16-0ubuntu0.24.04.2 (Accepted)

[Marc Deslauriers]

haproxy (2.8.16-0ubuntu0.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: HTTP/3 parser request smuggling issue
    - debian/patches/CVE-2026-33555.patch: check body size with
      content-length on empty FIN in src/h3.c.
    - CVE-2026-33555

haproxy (2.8.16-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version (LP: #2127664)
    - The API for the lua HTTPMessage "class" was improved to be able to
      change the body length. It was mandatory to be able to write a lua
      filter altering the message payload. HTTPMessage:set_body_len() can now
      be used for this purpose
    - Still in lua, The HTTP client is not supposed to be used to process
      several requests but there was nothing to prevent this usage. An error
      is now triggered in that case
    - For further information, see the upstream release notes:
      + https://www.mail-archive.com/haproxy@formilux.org/msg46201.html
  * d/p/CVE-2025-11230.patch: drop patch fixed upstream in 2.8.16

haproxy (2.8.15-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream version (LP: #2112526)
    - This new release introduce several fixes, including bug fixes for QUIC,
      for the SSL stack, and LUA.
    - New configuration options were introduced, and a new default value for
      the hard limit on the number of file descriptors was introduced. These
      are described in the Debian NEWS file.
    - For further information, see the upstream release notes:
      + https://www.mail-archive.com/haproxy@formilux.org/msg44606.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg44632.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg44787.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg44790.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45060.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45317.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45413.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45486.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45570.html
      + https://www.mail-archive.com/haproxy@formilux.org/msg45806.html
  * d/NEWS: add NEWS file.
  * Dropped paches applied upstream:
    - d/p/CVE-2024-53008-1.patch
    - d/p/CVE-2024-53008-2.patch
    - d/p/CVE-2025-32464.patch

Date: 2026-04-17 17:41:14.485053+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/haproxy/2.8.16-0ubuntu0.24.04.2
-------------- next part --------------
Sorry, changesfile not available.