HAProxy known bugs for maintenance branch 2.4 :  0 

This is maintenance branch 2.4 whose latest version is 2.4.36. If your version is not the last one in the maintenance branch, you are missing fixes for known bugs, and by not updating you are needlessly taking the responsibility for the risk of unexpected service outages and exposing your web site to possible security issues.

The HAProxy development team takes a great care of maintaining stable versions so that all users can apply bug fixes without having to take the risk of upgrading to a new branch. In turn users are expected to apply the fixes when the development team estimates that they were worth being backported to stable branches. In short, if you are running any 2.4 version other than 2.4.36, you're running with known bugs.

Quick links

Versions available in this branch

This branch contains the following releases :

DateVersionComment
2026-07-032.4.36 ⇐ last
2026-05-112.4.35 
2026-05-062.4.34 
2026-04-302.4.33 
2026-04-232.4.32 
2026-03-092.4.31 
2025-10-032.4.30 
2025-04-222.4.29 
2024-11-082.4.28 
2024-06-182.4.27 
2024-04-052.4.26 
2023-12-142.4.25 
2023-08-192.4.24 
2023-06-092.4.23 
2023-02-142.4.22 
2023-01-272.4.21 
2022-12-092.4.20 
2022-09-282.4.19 
2022-07-272.4.18 
2022-05-132.4.17 
2022-04-292.4.16 
2022-03-142.4.15 
2022-02-252.4.14 
2022-02-162.4.13 
2022-01-112.4.12 
2022-01-072.4.11 
2021-12-232.4.10 
2021-11-242.4.9 
2021-11-032.4.8 
2021-10-042.4.7 
2021-10-042.4.6 
2021-10-012.4.5 
2021-09-072.4.4 
2021-08-172.4.3 
2021-07-072.4.2 
2021-06-172.4.1 
2021-05-142.4.0 

Fixes for known bugs pending in this branch since the last release (2.4.36)

These fixes have already been queued for the next 2.4 release but no version was released with them yet. Note that fixes are backported several at a time from the development branch to maintenance branches, and the absence of a fix here doesn't mean none will be issued soon.

Bugs are almost always tagged with a severity (some people forget the severity tag when the bug is minor). The following severities are used :

Total known bugs in the latest version of this branch by category :

TotalCRITICALMAJORMEDIUMMINOR
0 0 0 0 0

Click on the subjects below to get the full description of the bug :

Merge dateSubject - Severity (minor, medium, major, critical)

Known bugs fixed in the development branch after the last commit in this branch

It is important to understand that not all of these commits are necessarily relevant to this version, but clicking on them will show the bug description. All fixes are made first in the development branch and then backported to the maintenance branches. This ensures no fix is lost when upgrading. If a fix was marked for backporting to this branch and is not there yet, it's likely that it is still missing. Do not hesitate to ask on the haproxy mailing list if you feel like a fix has been skipped.

DateSubject
2026-10-21BUG/MINOR: mux-quic: prevent send corruption on buf realign
2026-10-21BUG/MINOR: jwt: enforce the ECDSA signature length in jwt_verify
2026-10-21BUG/MINOR: jwe: only match the exact "ALL" word in jwt.decrypt_{alg,enc}_list
2026-10-21BUG/MINOR: jwe: reject non-empty encrypted keys with "dir" and "ECDH-ES"
2026-10-21BUG/MINOR: jwe: only accept exact "alg" and "enc" names in JWE tokens
2026-10-21BUG/MINOR: jws: fix ECDSA_SIG leak in jws_b64_signature()
2026-10-21BUG/MINOR: jwt: don't truncate binary HMAC secrets at the first NULL byte
2026-10-21BUG/MEDIUM: mux_quic: ensure FIN is reported after Rx data transfer
2026-10-21BUG/MEDIUM: mux_quic: fix crash on QCS double remote close
2026-10-21BUG/MEDIUM: task: do not destroy twice the tasks already killed in mworker_cleantasks()
2026-10-20BUG/MINOR: cfgparse/peers: warn and prevent undefined behavior when peers is missing bind info
2026-10-20BUG/MINOR: h3: fix crash with maxrewrite on response headers
2026-10-20BUG/MINOR: h3: enforce maxrewrite on request headers
2026-10-20BUG/MINOR: mux_quic: wake streams on soft-stop using listener socket
2026-10-20BUG/MEDIUM: h3: fix memory corruption on trailers parsing realign
2026-10-20BUG/MINOR: flt-decomp: Report error about filter order in lagacy mode only
2026-10-20Revert "BUG/MAJOR: mux-quic: do not crash on connection error after glitch threshold"
2026-10-20BUG/MINOR: h3: fix BUG_ON() crash with glitch on htx_set_eom() failure
2026-10-20BUG/MINOR: h3: fix risk of BUG_ON() crash with glitch on unknown frame
2026-10-20BUG/MEDIUM: h3: fix BUG_ON() crash with glitch after QPACK dec err
2026-10-20BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on GOAWAY parsing
2026-10-20BUG/MEDIUM: h3: fix BUG_ON() crash with glitch on SETTINGS parsing
2026-10-20BUG/MINOR: sample: Fix wrong 'base64urldec' return value check in 'jwt_member_query'
2026-10-19BUG/MEDIUM: bwlim: never burst more than the pending data in input
2026-10-19BUG/MINOR: filters: free the error message of the filter-config parsers
2026-10-19BUG/MEDIUM: h3: split absolute URIs like the HTTP analysers do on output
2026-10-19BUG/MAJOR: mux-h2: split absolute URIs like the HTTP analysers do on output
2026-10-19BUG/MAJOR: mux-quic: do not crash on connection error after glitch threshold
2026-10-19BUG/MEDIUM: resolvers: reject too long labels when encoding a name
2026-10-18BUG/MINOR: sym: don't crash on images linked at a fixed base
2026-10-16BUG/MINOR: mux-h1: Don't subscribe for receives once read0 or error received
2026-10-16BUG/MEDIUM: mux-h1: don't spread-close idle conns with idle-close-on-response
2026-10-16BUG/MINOR: mux-h1: don't forward request trailers named like server name header
2026-10-16BUG/MINOR: mux-h1: search the websocket key in the right message
2026-10-16BUG/MINOR: mux-h1: only rely on the client's method for bodyless responses
2026-10-16BUG/MEDIUM: h1: reject absolute http(s) URIs with an empty host
2026-10-16BUG/MINOR: mux-h1: convert the argument of h1-case-adjust to lower case
2026-10-16BUG/MEDIUM: mux-h1: don't send chunked responses to HTTP/1.0 clients
2026-10-16BUG/MINOR: h1: forget a previous pass' results when parsing headers only
2026-10-16BUG/MINOR: h1: reject CONNECT authorities with an empty host
2026-10-16BUG/MEDIUM: h1: build a missing Host header from the authority of the URI
2026-10-16BUG/MEDIUM: mux-h1: don't lose error responses once a content-length was parsed
2026-10-16BUG/MINOR: mux-h1: report payload parsing glitches to the session
2026-10-16BUG/MEDIUM: mux-h1: don't swap buffers when transferring data with a reserved offset
2026-10-16BUG/MINOR: mux-h1: don't report a 408 error on timeout of a closed connection
2026-10-16BUG/MINOR: mux-h1: don't keep fast-forwarding disabled for the next streams
2026-10-16BUG/MINOR: mux-h1: reset the content-length/chunking state after a 1xx response
2026-10-16BUG/MEDIUM: mux-h1: don't stall when draining more than a buffer of data
2026-10-16BUG/MEDIUM: mux-h1: don't lose the end of the previous chunk in h1_make_chunk()
2026-10-16BUG/MEDIUM: h1: reject CONNECT request targets other than "host:port"
2026-10-16BUG/MINOR: mux-h1: don't dereference a NULL opposite sedesc in h1_fastfwd()
2026-10-16BUG/MINOR: mux-h1: wake the connection up when a pending error can be sent
2026-10-16BUG/MINOR: mux-h1: fix the open streams counter on stream creation failure
2026-10-16BUG/MINOR: mux-h1: only reset the session's timing info on the frontend side
2026-10-16BUG/MINOR: h1: don't use uninitialized start line pointers when restarting
2026-10-16BUG/MEDIUM: mux-h1: don't truncate responses on soft-stop
2026-10-16BUG/MEDIUM: mux-h1: don't truncate the response when closing after draining
2026-10-16BUG/MEDIUM: h1-htx: don't stall on messages ending exactly at the buffer's end
2026-10-16BUG/MEDIUM: h1: don't rewrite the Upgrade header when not cleaning headers
2026-10-16BUG/MINOR: h1: keep accepting unsafe violations after a parser reset
2026-10-16BUG/MEDIUM: h1: make the Connection/Upgrade headers cleanup idempotent
2026-10-16BUG/MEDIUM: mux-h1: Don't close the connection on a payload parsing error
2026-10-16BUG/MINOR: filters: fix silent compression disable with legacy "filter compression" first
2026-10-16BUG/MEDIUM: cli: Fix parsing of big payloads with dynamically allocated buffer
2026-10-16BUG/MINOR: quic: valid NEW_TOKEN connections are counted as half-open
2026-10-16BUG/MEDIUM: peers: keep the earliest sync task deadline
2026-10-16BUG/MINOR: mux_quic: do not crash on SE_SHR_DRAIN shut
2026-10-16BUG/MINOR: check: do not inspect errno if conn FDLESS
2026-10-16BUG/MINOR: mux_quic: prevent RS/SS on unistream with hq-interop
2026-10-16BUG/MEDIUM: mux_quic: prevent uaf on fctl frame after send error
2026-10-16BUG/MINOR: quic: handle EINTR on emission of packets without connection
2026-10-16BUG/MINOR: quic: use datagram destination as source for version negotiation
2026-10-16BUG/MINOR: quic: use datagram destination as source for stateless reset
2026-10-16BUG/MEDIUM: quic: use datagram destination as source for Retry
2026-10-15BUG/MINOR: quic: rearm packet on packet received even non ack-eliciting
2026-10-15BUG/MEDIUM: stats-file: shm-stats-file be counters not working anymore
2026-10-14BUG/MAJOR: h1-htx: report an error on a too long chunk-size line
2026-10-14BUG/MAJOR: mux-h2: properly handle short reads on PING frames
2026-10-13BUG/MINOR: cfgparse-global: only warn when "localpeer" is set together with -L
2026-10-12BUG/MEDIUM: mux-h1: only accept the H2 preface on the first request
2026-10-12BUG/MINOR: http-fetch: don't report pseudo-headers in TCP mode
2026-10-12BUG/MEDIUM: mux-h1: also release the embryonic stream when the error is empty
2026-10-12BUG/MEDIUM: mux-h2: fix a possible crash on rxbuf allocation failure
2026-10-12BUG/MEDIUM: mux-h2: report a dead rhttp connection in h2_wake()
2026-10-12BUG/MEDIUM: mux-h1: don't pass an upgraded connection to traces in h1s_destroy()
2026-10-12BUG/MEDIUM: mux-fcgi: don't return a freed tasklet from fcgi_deferred_shut()
2026-10-12BUG/MEDIUM: mux-h2: don't return a freed tasklet from h2_deferred_shut()
2026-10-12BUG/MINOR: hlua: assume proxy_find_by_id() may return NULL on previously existing server
2026-10-09BUG/MEDIUM: spoe: Let an agent outlive its applets during a backend deletion
2026-10-09BUG/MINOR: flt-http-comp: Enable implicit filters independently per direction
2026-10-09BUG/MINOR: flt-decomp: Fix the decompression filter keyword list name
2026-10-09BUG/MINOR: spoe: Fix the message list splice with an empty list
2026-10-09BUG/MEDIUM: log: do not ignore the peer's shutdown in the syslog applet
2026-10-09BUG/MEDIUM: cli: fix the last command detection on a full command line
2026-10-09BUG/MINOR: cfgparse-listen: complete the list of options for the suggestions
2026-10-09BUG/MINOR: proxy: also look for the closest option among cfg_opts3
2026-10-09BUG/MINOR: cfgparse-listen: properly reject extra args in a backend section
2026-10-09BUG/MINOR: cfgparse-listen: don't lose the errors reported while creating a proxy
2026-10-09BUG/MINOR: cfgparse-listen: always reject extra arguments to "persist"
2026-10-09BUG/MINOR: cfgparse-global: reject extra arguments to numa-cpu-mapping and anonkey
2026-10-09BUG/MINOR: cfgparse-listen: fix quoting of the condition conflict warning
2026-10-09BUG/MINOR: cfgparse-listen: fix the argument checked by "email-alert"
2026-10-09BUG/MINOR: cfgparse-listen: release the previous description of the proxy
2026-10-09BUG/MINOR: cfgparse-global: add missing calloc() check for the global description
2026-10-09BUG/MINOR: cfgparse-global: add missing gotos to error label in max-spread-checks
2026-10-09BUG/MAJOR: cfgparse: properly check userlist section when scanning keywords
2026-10-08BUG/MEDIUM: h3: fix incorrect DATA size block on DEM FULL
2026-10-08BUG/MEDIUM: h3: fix end-of-input report on DATA wrapping
2026-10-07BUG/MINOR: ssl: Fix potential NULL-deref in "dump ssl cert" with AWS-LC
2026-10-07BUG/MEDIUM: mux_quic: notify stream on RESET_STREAM reception
2026-10-07BUG/MINOR: h3: reject RS/SS for QPACK uni streams
2026-10-07BUG/MINOR: h3: close connection on GOAWAY frame too long
2026-10-07BUG/MINOR: h3: reject frames with truncated header
2026-10-07BUG/MINOR: mux_quic: account data in conn fctl on early detach
2026-10-07BUG/MEDIUM: mux_quic: account discarded data in connection flow control
2026-10-07BUG/MINOR: mux_quic: report conn error on RESET_STREAM fctl violation
2026-10-06BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream
2026-10-06BUG/MINOR: mux_quic: prevent purgeable QCS lingering
2026-10-06BUG/MAJOR: mux-quic: prevent crash on QCS already set for purging
2026-10-06BUG/MINOR: ssl: use standard names for X25519 and X448 groups
2026-10-06BUG/MINOR: ssl: don't uppercase the native group name
2026-10-06BUG/MEDIUM: listener: Consider maxconn before waking listeners
2026-10-06BUG/MEDIUM: ssl: crt-list curves ignored with AWS-LC
2026-10-06BUG/MEDIUM: ssl: crt-list ciphers ignored with AWS-LC
2026-10-06BUG/MINOR: ssl: fix trace crash on BE conn release in io cb
2026-10-06BUG/MINOR: ssl: fix trace crash on FE conn release in io cb
2026-10-06BUG/MINOR: hq-interop: prevent double EOM on request with standalone FIN
2026-10-06DEBUG: support reading set-dumpable from HAPROXY_FORCE_DUMPABLE
2026-10-05BUG/MINOR: log: fix erroneous error message in log-steps parser
2026-10-02BUG/MEDIUM: server: remove immediately from GUID tree on delete server
2026-10-02BUG/MINOR: cli: update wait help usage
2026-10-02BUG/MINOR: server: fix "del server" description
2026-10-02BUG/MINOR: proxy: add PR_CAP_LB for dynamically added backend
2026-09-30BUG/MINOR: sample: return the decoded JWT part when no path is given
2026-09-30BUG/MEDIUM: tcpcheck: do not run a regex on an unallocated buffer
2026-09-30BUG/MINOR: http-fetch: do not count Set-Cookie attributes as cookies
2026-09-30BUG/MINOR: payload: always report a boolean from req.ssl_ec_ext
2026-09-30BUG/MINOR: stick-table: do not count the lookup itself in table_trackers()
2026-09-30BUG/MINOR: http-ana: return a 502 when checkcache blocks a response
2026-09-30BUG/MINOR: sample: make quic_enabled() always succeed
2026-09-30BUG/MINOR: sample: zero-pad the fractional part emitted by http_date()
2026-09-30BUG/MINOR: sample: apply the ms_/us_ time offsets in the input unit
2026-09-30BUG/MINOR: http: do not consume the delimiter of a truncated q-factor
2026-09-30BUG/MINOR: startup: don't chroot by default when set-dumpable is set
2026-09-30BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5)
2026-09-30BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5
2026-09-30BUG/MEDIUM: pattern: don't dereference static_pattern's data when not filling it
2026-09-29BUG/MEDIUM: stick-table: restrict key sizes to what fits in a buffer
2026-09-29BUG/MINOR: mux-h1: Discard pending raw data after a tunnel rejection
2026-09-29BUG/MEDIUM: mux-h1: Don't subscribe for sends while output is blocked
2026-09-29BUG/MAJOR: mux-h2: Preserve raw data on aborted frontend tunnels
2026-09-29BUG/MINOR: chunk: Allow large chunks uses from large const buffers
2026-09-28BUG/MEDIUM: server: skip log backend addr checks for internal proxies
2026-09-28BUG/MEDIUM: sink: reconnect attempt not working after session lasted more than ~25 days
2026-09-28BUG/MAJOR: mux_quic: fix potential crash on RESET_STREAM receive
2026-09-27BUG/MINOR: ssl: free curves, sigalgs and client_sigalgs in srv_parse_*()
2026-09-27BUG/MINOR: ssl: free curves, sigalgs and client_sigalgs in ssl_sock_free_srv_ctx()
2026-09-27BUG/MINOR: ssl: copy curves, sigalgs and client_sigalgs in srv_ssl_settings_cpy()
2026-09-27BUG/MINOR: acme: exact domain match in acme_challenge_ready()
2026-09-24BUG/MINOR: h2: reject :protocol pseudo-header in H2 responses
2026-09-24BUG/MEDIUM: mux_quic: activate timeout on FE init
2026-09-24BUG/MAJOR: mux_quic: fix leak on RESET_STREAM reception
2026-09-24BUG/MEDIUM: h3: Set FIN when last DATA block is sent via zero-copy
2026-09-23BUG/MINOR: http-ana: restore the transaction status after early hints
2026-09-23BUG/MINOR: tcpcheck: refresh the start-line after updating the authority
2026-09-23BUG/MINOR: mux-h1: only mark C-L and T-E as sent once the header is emitted
2026-09-23BUG/MINOR: http-fetch: fix the space check of http_auth_bearer()
2026-09-23BUG/MINOR: http-fetch: http_auth_bearer() must not match a missing header
2026-09-23BUG/MINOR: http-ana: count response body failures only once in http_fail_cnt
2026-09-23BUG/MEDIUM: tcp-rules: ignore "capture len" rules evaluated from a backend
2026-09-23BUG/MEDIUM: http-act: ignore "capture len" rules evaluated from a backend
2026-09-23BUG/MEDIUM: http-htx: don't build the new authority in a rotating trash chunk
2026-09-23BUG/MEDIUM: log: reserve the trailing 0 in CBOR int and bool encoders
2026-09-23BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses
2026-09-23BUG/MEDIUM: h1-htx: Don't report EOM for H1 interim responses during parsing
2026-09-21BUG/MINOR: http-client: Convert server timeout ticks when setting it
2026-09-21BUG/MINOR: ssl: Fix possible null deref on the SSL context in ssl_sock_to_buf()
2026-09-21BUG/MINOR: hlua: release private Lua rule data on teardown
2026-09-18BUG/MINOR: mux-h2: Reject trailers received on a tunneled stream
2026-09-18BUG/MAJOR: htx: Check the header/trailer length limits when one is updated
2026-09-18BUG/MINOR: tools: Don't try to anonymize a NULL string
2026-09-18BUG/MEDIUM: htx: Fix the position returned by htx_defrag()
2026-09-18BUG/MINOR: ssl/ocsp: Report an error when an empty OCSP response is received
2026-09-18BUG/MEDIUM: http-client/cli: Notify the http-client when the response is consumed
2026-09-18BUG/MEDIUM: acme: Set HTTPCLIENT_O_RES_ACCUM option on the http-client
2026-09-18BUG/MEDIUM: ssl/ocsp: Set HTTPCLIENT_O_RES_ACCUM option on the http-client
2026-09-18BUG/MEDIUM: http-client: Don't use the httpclient context if it was released
2026-09-18BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy
2026-09-16BUG/MINOR: proxy: pass PR_FL_DEF_EXPLICIT_MODE through cascaded defaults
2026-09-15BUG/MEDIUM: tcp-rules: Don't restart tcp-request content evaluation on yield
2026-09-15BUG/MEDIUM: htx: Reserve a block descriptor for zero-sized blocks
2026-09-14BUG/MEDIUM: ssl: don't set a 0 timeout on an expired TLS session
2026-09-11BUG/MINOR: sample: reject a \0 byte in url_dec, json_query and jwt_*_query
2026-09-11BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry
2026-09-11BUG/MINOR: pattern: do not match a string with an embedded \0 on its prefix
2026-09-11BUG/MINOR: cli: Reject payload with no command
2026-09-11BUG/MEDIUM: cli: Don't read a command or payload line into a full buffer
2026-09-11BUG/MEDIUM: cli: Don't parse next command if input buffer is empty
2026-09-11BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a condition
2026-09-10BUG/MINOR: stream: resolve foreign groups' addresses for "show sess"
2026-09-10BUG/MEDIUM cli: dump other thread groups' FDs from their own threads
2026-09-10BUG/MEDIUM: listener: Don't drop suspend/resume deferred requests
2026-09-10BUG/MINOR: cli: Make sure two instances of _getsocks don't run
2026-09-10BUG/MEDIUM: map: do not overwrite the fetch context in pat_match_regm()
2026-09-10BUG/MINOR: ssl: don't pass the address of a size_t as an int* to OpenSSL
2026-09-08BUG/MEDIUM: http-ana: apply tunnel timeout with data filters
2026-09-08BUG/MINOR: h3: only increment frame type counter on new header
2026-09-08BUG/MINOR: h3: handle unknown frame type on request stream as specified
2026-09-08BUG/MINOR: h3: handle empty HEADERS frame as specified
2026-09-08BUG/MEDIUM: h3: do not block FIN on empty DATA frame
2026-09-08BUG/MINOR: h3: reject truncated frames with mandatory payload
2026-09-04BUG/MINOR: stream/debug: harden the stream dump function regarding signals
2026-09-04BUG/MINOR: flt-http-comp: Rely on htx_set_eom() to restore EOM flag
2026-09-04BUG/MEDIUM: htx: Don't reset flags when source must be preserved during transfer
2026-09-04BUG/MINOR: hlua: Always return nil if there is no data to dup for HTTP messages
2026-09-04BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished
2026-09-04BUG/MEDIUM: hlua: Never release a cosocket applet from the GC
2026-09-03BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure
2026-09-03BUG/MAJOR: h3: reject H3 truncated frames
2026-09-03BUG/MEDIUM: mux-h2: Make sure we remove H2_SF_NOTIFIED on subscribe
2026-09-03BUG/MINOR: debug: restore complain tail jumps with clang
2026-09-03BUG/MEDIUM: log: encode the whole non-printable range in the +json output
2026-09-03BUG/MINOR: tools: support the documented NULL in cbor_encode_bytes_prefix_bin()
2026-09-02BUG/MINOR: quic: delete the wrong CIDs when post-handshake frames fail
2026-09-02BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached
2026-09-02BUG/MINOR: qpack: encoder and decoder stream data is never consumed
2026-09-01BUG/MINOR: resolvers: classify empty truncated responses
2026-09-01BUG/MEDIUM: resolvers: Use the right server to init DNS streams
2026-09-01BUG/MEDIUM: filters: check the filter name before comparing it
2026-08-31BUG/MINOR: quic: late packets of the first key phase are dropped
2026-08-31BUG/MEDIUM: quic: crash on key update phase change after a failed one
2026-08-29BUG/MINOR: payload: bound ClientHello extension lists by the extension length
2026-08-29BUG/MINOR: payload: fix the cipher_len bound check in smp_client_hello_parse()
2026-08-28BUG/MINOR: quic: fix zero value of tune.quic.sec.stateless-reset-rate
2026-08-28BUG/MEDIUM: server: Fix server-template with default-server
2026-08-28BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames
2026-08-26BUG/MINOR: cache: Seed cache primary hash
2026-08-26BUG/MINOR: cache: Manage collisions on primary key
2026-08-26BUG/MINOR: haload: fix hld_new_usr()'s error path
2026-08-26BUG/MEDIUM: sink: do not create one implicit ring per logger copy
2026-08-26BUG/MEDIUM: sink: initialize the settings of the implicit log server
2026-08-26BUG/MEDIUM: flt-http-comp: Block HTX_FL_EOM flag till the end of compression
2026-08-26BUG/MINOR: flt-http-comp: Don't read next block to detect end of data
2026-08-26BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters
2026-08-26BUG/MEDIUM: cache: ignore cache on redundant origin/referer
2026-08-25BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages()
2026-08-25BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch
2026-08-25BUG/MEDIUM: mux-h1: close the connection on a short content-length
2026-08-24BUG/MINOR: haload: -ee could burst past its floor when many users fail at once
2026-08-24BUG/MINOR: haload: split the rate exactly across threads
2026-08-24BUG/MINOR: haload: make -e react to request timeouts too
2026-08-24BUG/MINOR: haload: count timed-out requests as errors, not successes
2026-08-19BUG/MEDIUM: sink: pre-initialize the implicit log forwarding server
2026-08-19BUG/MINOR: dns: schedule idle task after setting its thread
2026-08-19BUG/MINOR: resolvers: accept fields at the response boundary
2026-08-18BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f'
2026-08-18BUG/MINOR: haproxy: fix out-of-scope tmpdir usage in do_chroot()
2026-08-18BUG/MEDIUM: pollers: really create the poller pipes in builds without threads
2026-08-18BUG/MEDIUM: tasks: don't type-pun state and tid in builds without threads
2026-08-18BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy
2026-08-18BUG/MINOR: ssl: isolate TLS session resumption per crt-list filter
2026-08-18BUG/MEDIUM: ssl: isolate TLS session resumption per X509 server certificate
2026-08-18BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC
2026-08-18BUG/MEDIUM: ssl: enforce tune.ssl.lifetime across TLS1.3 session renewals
2026-08-17BUG/MEDIUM: ssl: Fix unprotected 'ssl_sock_choose_sni_ctx' calls
2026-08-17BUG/MINOR: ssl: release the previous client cert reference at depth > 0
2026-08-17BUG/MINOR: ssl: Fix leak of X509_NAME in traces
2026-08-17BUG/MINOR: conn: Do not check 'sess_el' list on frontend connections in __trace_enabled
2026-08-14BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd
2026-08-14BUG/MINOR: uri-auth: never risk to dereference a NULL on error path
2026-08-14BUG/MINOR: log: fix double-free error when error in parse_loger occurs
2026-08-14BUG/MEDIUM: tasks: don't type-pun state and tid in builds without threads
2026-08-14BUG/MEDIUM: pollers: create the poller pipes in builds without threads
2026-08-14BUG/MINOR: qpack: missing shift count check in qpack_get_varint() (UB)
2026-08-14BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var
2026-08-13BUG/MINOR: payload: fix handshake length off-by-4 in ssl_hello_sni/alpn
2026-08-13CLEANUP: debug: make __BUG_ON() use abort_with_line()
2026-08-13MINOR: debug: rely on the __dbg_cnt_ counter for _BUG_ON_ONCE()
2026-08-13MINOR: debug: make a pair of __BUG_ON() for modern and obsolete linkers
2026-08-13CLEANUP: debug: remove the unneeded do { } while (0) on __BUG_ON()
2026-08-13MINOR: debug: avoid the break in __BUG_ON()
2026-08-13MINOR: debug: unify __BUG_ON() and __BUG_ON_ONCE()
2026-08-13MINOR: debug: pass the type to the __BUG_ON*() macros
2026-08-13DEBUG: deduplicate __ABORT_NOW() between DEBUG_USE_ABORT and ha_crash_now()
2026-08-13DEBUG: cli: add a "debug dev abort" debugging command
2026-08-13MINOR: debug: check the match count in __BUG_ON_ONCE() and not in complain()
2026-08-13DEBUG: cli: unstatify cli_process_cmdline()
2026-08-13BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode
2026-08-13BUG/MEDIUM: http: fix authority parsing for absolute-form URI with empty path
2026-08-12BUG/MINOR: server: fix off-by-one error when parsing and copying source port range
2026-08-12BUG/MINOR: hq_interop: fix potential NULL dereference in _hq_trace_http()
2026-08-12BUG/MINOR: h3: fix potential NULL pointer dereference in _h3_trace_header()
2026-08-12BUG/MINOR: server: fix memory leak on "default-server" parsing failures
2026-08-12BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval
2026-08-12BUG/MINOR: ssl: reject an embedded NUL in the full-DN ssl_*_dn() fetches
2026-08-12BUG/MINOR: ssl: reject an embedded NUL in the ssl_*_dn(entry) fetches
2026-08-12BUG/MINOR: wurfl: fix memory leak of information list and patch strings at deinit
2026-08-12BUG/MEDIUM: cache: do not release an entry under the cache read lock
2026-08-12BUG/MINOR: cache: do not retain imcomplete or stripped secondary entry
2026-08-12BUG/MEDIUM: cache: retain the primary or secondary entry only when detaching its row
2026-08-10BUG/MEDIUM: hlua_fcn: ensure systematic bref cleanup for patref list iterator
2026-08-10BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string
2026-08-07BUG/MINOR: quic: drop multiple Retry on same connection
2026-08-07BUG/MEDIUM: quic: prevent out-of-bound read on wrapping CRYPTO content
2026-08-07BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server
2026-08-07BUG/MINOR: debug: only dump the trace once in __BUG_ON_ONCE()
2026-08-07BUG/MINOR: lb-chash: bound the walk when the saved cursor changed tree
2026-08-07BUG/MEDIUM: session: don't release a reversed connection twice on error
2026-08-07BUG/MINOR: connection: reserve the whole CRC32C TLV before saving its pointer
2026-08-07BUG/MEDIUM: fd: release the port range entry in host byte order
2026-08-07BUG/MINOR: acme: restrict the permissions of the generated account key
2026-08-07BUG/MINOR: ssl: reject server certificate names containing a NUL byte
2026-08-07BUG/MEDIUM: acme: don't delete a NULL token from the map
2026-08-07BUG/MEDIUM: ssl: require a full-length AEAD tag when decrypting with AES-GCM
2026-08-07BUG/MINOR: jwt: don't take an extra reference on the certificate public key
2026-08-07BUG/MEDIUM: jwe: validate the secret length against the algorithm of the token
2026-08-07BUG/MEDIUM: log: always reserve room for trailing 0 when using CBOR encoding helpers
2026-08-07BUG/MINOR: mux-fcgi: sanitize the STDERR records before logging them
2026-08-07BUG/MEDIUM: http-ana: check the cookie rewrite result before moving the offsets
2026-08-07BUG/MEDIUM: sock: bound the recvmsg() length when receiving old sockets
2026-08-07BUG/MEDIUM: stick-tables: use the same bucket for string keys with a NUL
2026-08-07BUG/MEDIUM: http-ana: don't crash on "keep-query" in a response redirect
2026-08-07BUG/MINOR: mux-fcgi: don't call fcgi_strm_destroy() on a NULL stream
2026-08-07BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start
2026-08-07BUG/MEDIUM: mux-fcgi: check the room left before appending the index
2026-08-06BUG/MINOR: hlua: use a local buffer to format the socket addresses
2026-08-06BUG/MINOR: stats-file: reject tgid 0 when preloading shm objects
2026-08-06BUG/MEDIUM: hpack: encode long methods and schemes using the long form
2026-08-06BUG/MINOR: proxy: release watcher in "show default-server" on CLI abort
2026-08-06BUG/MINOR: proxy: release watcher in various commands on CLI abort
2026-08-05BUG/MINOR: proxy: fix "show backend"
2026-08-03BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup
2026-08-03BUG/MINOR: ech: fix label at end of compound statement
2026-08-03BUG/MINOR: server: check strdup return on server-template ID generation
2026-08-03BUG/MINOR: server: check strdup return value on server ID
2026-07-31BUG/MINOR: haload: fix stale global variables affecting URL allocations
2026-07-30BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering
2026-07-30BUG/MEDIUM: counters: preserve shared.tg pointer on 'clear counters all'
2026-07-30BUG/MINOR: ech: reject an ECH store with no usable private key
2026-07-30BUG/MINOR: ech: propagate error from load_echkeys()
2026-07-30BUG/MINOR: haload: fix rate limit bypass during stream errors
2026-07-29BUG/MINOR: cli: do not reject the "/" form of "show fd"
2026-07-29BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd"
2026-07-29BUG/MINOR: server: fix check reuse-pool in srv_settings_cpy()
2026-07-29BUG/MINOR: server: duplicate server alt_proto in srv_settings_cpy()
2026-07-29BUG/MINOR: server: fix QUIC on server-template
2026-07-28BUG/MAJOR: ssl/ocsp: lock the OCSP response around reads in the stapling callback
2026-07-28BUG/MEDIUM: sample: reject the deprecated protobuf group wire types
2026-07-28BUG/MEDIUM: peers: check the available room before encoding dict values
2026-07-28BUG/MINOR: slz: avoid undefined shifts when building the word byte by byte
2026-07-28BUG/MINOR: slz: fix the adler32 accumulators signedness on 32-bit
2026-07-28BUG/MINOR: slz: do not append a block to an already finished stream
2026-07-28BUG/MEDIUM: slz: bound the bits wasted by the 9-bit literals
2026-07-28BUG/MINOR: slz: use the exact switch cost for the last literals of a block
2026-07-28BUG/MINOR: slz: do not read past the end of the input around the match loop
2026-07-28BUG/MINOR: http-rules: fix release of a failed "set-cookie-fmt" redirect rule
2026-07-28BUG/MINOR: htx: Transfer HTX_FL_EOM flag on success in htx_append_msg()
2026-07-28BUG/MINOR: htx: Perform raw copy for messages of same size in htx_copy_msg()
2026-07-28BUG/MEDIUM: tools: make string encoding possible to fail instead of truncating
2026-07-27BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument
2026-07-27BUG/MINOR: http-act: reject a negative capture id in the capture actions
2026-07-27BUG/MINOR: http-act: work on a copy of the sample in del-headers-bin
2026-07-27BUG/MINOR: http-act: restore the response buffer state in the early-hint action
2026-07-27BUG/MINOR: http-act: fix a double free of the map reference on a parsing error
2026-07-27BUG/MINOR: http-act: fix a double free of the regex on a rule parsing error
2026-07-27BUG/MINOR: http-ana: fix a one-byte over-read in the client-side cookie parser
2026-07-27BUG/MINOR: h3: don't use a block pointer to roll back a partial HTX conversion
2026-07-27BUG/MINOR: h2: don't use a block pointer to roll back a partial HTX conversion
2026-07-27BUG/MINOR: h1: report the right error position on authority/host mismatch
2026-07-27BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize()
2026-07-27BUG/MINOR: http: fix an out-of-bounds read in http_get_host_port() on empty host
2026-07-27BUG/MINOR: http-fetch: fix a NULL channel dereference in smp_fetch_body()
2026-07-27BUG/MEDIUM: http-fetch: reject a negative capture id in capture.{req,res}.hdr
2026-07-27BUG/MEDIUM: http-fetch: don't parse a non-HTTP check buffer as an HTX message
2026-07-27BUG/MINOR: http-htx: fix the length moved when removing a header value
2026-07-24BUG/MINOR: haload: fix CPU topology detection by omitting forced "nbthread"
2026-07-24BUG/MEDIUM: mux-h1: Always adjust case for all outgoing headers as expected
2026-07-24DEBUG: fd: catch access attempts to closed FDs
2026-07-24BUG/MEDIUM: ssl: Put CO_ER_SSL_KEYUPDATE at the right place
2026-07-24BUG/MEDIUM: ssl: Handle non-application data record while splicing
2026-07-23BUG/MEDIUM: ssl: Spell HAVE_VANILLA_OPENSSL correctly
2026-07-23BUG/MINOR: haload: fix display glitches by flushing stdout in summary
2026-07-23BUG/MINOR: haload: set default thread count to 1
2026-07-23BUG/MINOR: haload: fix use-after-free upon updating task expiration
2026-07-23BUG/MEDIUM: proxy: protect "show errors" against backend deletion
2026-07-22BUG/MINOR: resolvers: do not index resolvers names in the proxies
2026-07-22BUG/MEDIUM: server: Properly check for streams before deletion
2026-07-21BUG/MEDIUM: proxy: protect show backend against be deletion
2026-07-21BUG/MEDIUM: proxy: protect "show servers ..." against backend deletion
2026-07-21BUG/MEDIUM: proxy: protect "show servers ..." against server deletion
2026-07-21BUG/MINOR: sample: Fix bytes() when length it greater than remaining data
2026-07-21BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for ltrim()
2026-07-21BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes()
2026-07-21BUG/MEDIUM: net-helper: Adjust sample size capacity after pointer shift
2026-07-21BUG/MINOR: mux-h1: Don't delay send if message with c-l was fully sent
2026-07-16CLEANUP: event_hdl: Use BUG_ON_STATIC()
2026-07-16DEBUG: add BUG_ON_STATIC(): a compile-time BUG_ON()
2026-07-16BUG/MINOR: ssl: fix proxy lookup for show ssl sni
2026-07-16BUG/MEDIUM: protobuf: fix nested path bypass in field lookup
2026-07-16BUG/MEDIUM: protobuf: adjust sample size capacity after pointer shift
2026-07-15BUG/MEDIUM: ssl-gencert: Don't forget to free memory when done
2026-07-15BUG/MEDIUM: stats: Ensure that Origin is valid on POSTs
2026-07-10BUG/MEDIUM: cache: reattach the row when a secondary entry is incomplete
2026-07-10BUG/MINOR: shctx: fix shctx_row_data_get() when offset exceeds a block
2026-07-10BUG/MEDIUM: stats: subject "stats admin" accesses to "stats scope" filtering
2026-07-10BUG/MEDIUM: applet: Reenable reads in applet context if requesting a connection
2026-07-10BUG/MINOR: hlua: Apply socket timeout on server side only
2026-07-08BUG/MINOR: http-conv: Make url-dec failed if no space for trailing null byte
2026-07-08BUG/MINOR: stream: Fix custom max-retries initialization when setting backend
2026-07-08BUG/MINOR: stream: Fix custom timeouts initialization when setting backend
2026-07-08BUG/MEDIUM: chunk: Review chunks usage to not retrieve a large buffer by error
2026-07-08BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size
2026-07-08BUG/MEDIUM: tcpcheck: Add proxy used for healthcheck sections in proxies list
2026-07-08BUG/MINOR: hbuf: treat unexpected escape sequences as literals
2026-07-08BUG/MINOR: haload: fix spurious task wakeup in hld_strm_task()
2026-07-06BUG/MEDIUM: fd: Fix a deadlock when closing other tgroups fds
2026-07-06BUG/MINOR: quic: ignore STREAM after MUX closure on BE side
2026-07-06BUG/MEDIUM: mux_quic: complete stream shutdown for read channel
2026-07-06BUG/MEDIUM: mux_quic: do not free QCS if STOP_SENDING to sent
2026-07-03BUG/MINOR: trace/quic_frame: use buf, not trace_buf in chunk_frm_appendf()
2026-07-03BUG/MINOR: mux_quic: prevent multiple STOP_SENDING emission per stream
2026-07-03BUG/MEDIUM: h3: fix parser desync on error with multiple frames

Back to the list of branches and versions
Back to the HAProxy page