HAProxy known bugs for version v3.2.22 (maintenance branch 3.2) :  108 

This version (3.2.22) is a release belonging to maintenance branch 3.2 whose latest version is 3.2.23. If your version is not the last one in the maintenance branch, you are missing fixes for known bugs, and by not updating you are needlessly taking the responsibility for the risk of unexpected service outages and exposing your web site to possible security issues.

The HAProxy development team takes a great care of maintaining stable versions so that all users can apply bug fixes without having to take the risk of upgrading to a new branch. In turn users are expected to apply the fixes when the development team estimates that they were worth being backported to stable branches.

Quick links

Other versions in the same branch

This branch contains the following releases :

DateVersionComment
2026-08-273.2.23 ⇐ last
2026-07-293.2.22 ⇐ yours
2026-07-033.2.21 
2026-06-263.2.20 
2026-05-113.2.19 
2026-05-063.2.18 
2026-04-303.2.17 
2026-04-233.2.16 
2026-03-193.2.15 
2026-03-093.2.14 
2026-02-193.2.13 
2026-02-123.2.12 
2026-01-293.2.11 
2025-12-183.2.10 
2025-11-213.2.9 
2025-11-073.2.8 
2025-10-233.2.7 
2025-10-033.2.6 
2025-09-233.2.5 
2025-08-133.2.4 
2025-07-093.2.3 
2025-07-023.2.2 
2025-06-113.2.1 
2025-05-283.2.0 

Known bugs affecting this version, and already fixed in the maintenance branch

These fixes have already been queued for a more recent 3.2 version. Some of them might have already been released in a more recent version than yours, and other ones might still be pending in the maintenance branch for a future release. The list may be empty if you're already on the latest version and no new fix was backported.

Bugs are almost always tagged with a severity (some people forget the severity tag when the bug is minor). The following severities are used :

Total known bugs in this version by category :

TotalCRITICALMAJORMEDIUMMINOR
108 0 1 44 63

Click on the subjects below to get the full description of the bug :

Merge dateSubject - Severity (minor, medium, major, critical)
2026-09-17BUG/MEDIUM: mux_quic: do not free QCS if STOP_SENDING to sent
2026-09-17BUG/MEDIUM: limits: properly account for global.maxpipes in compute_ideal_maxconn()
2026-09-17BUG/MEDIUM: tcp-rules: Don't restart tcp-request content evaluation on yield
2026-09-17BUG/MEDIUM: htx: Reserve a block descriptor for zero-sized blocks
2026-09-17BUG/MEDIUM: ssl: don't set a 0 timeout on an expired TLS session
2026-09-17BUG/MINOR: sample: reject a \0 byte in url_dec, json_query and jwt_*_query
2026-09-17BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry
2026-09-17BUG/MEDIUM: cli: Don't read a command or payload line into a full buffer
2026-09-17BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a condition
2026-09-17BUG/MEDIUM: map: do not overwrite the fetch context in pat_match_regm()
2026-09-17BUG/MINOR: ssl: don't pass the address of a size_t as an int* to OpenSSL
2026-09-17BUG/MEDIUM: http-ana: apply tunnel timeout with data filters
2026-09-17BUG/MINOR: h3: only increment frame type counter on new header
2026-09-17BUG/MINOR: h3: handle unknown frame type on request stream as specified
2026-09-17BUG/MINOR: h3: handle empty HEADERS frame as specified
2026-09-17BUG/MEDIUM: h3: do not block FIN on empty DATA frame
2026-09-17BUG/MINOR: stream/debug: harden the stream dump function regarding signals
2026-09-17BUG/MINOR: hlua: Always return nil if there is no data to dup for HTTP messages
2026-09-17BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished
2026-09-17BUG/MEDIUM: hlua: Never release a cosocket applet from the GC
2026-09-17BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure
2026-09-17BUG/MAJOR: h3: reject H3 truncated frames
2026-09-17BUG/MEDIUM: mux-h2: Make sure we remove H2_SF_NOTIFIED on subscribe
2026-09-17BUG/MINOR: quic: delete the wrong CIDs when post-handshake frames fail
2026-09-17BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached
2026-09-17BUG/MINOR: qpack: encoder and decoder stream data is never consumed
2026-09-17BUG/MINOR: resolvers: classify empty truncated responses
2026-09-17BUG/MINOR: quic: late packets of the first key phase are dropped
2026-09-17BUG/MEDIUM: quic: crash on key update phase change after a failed one
2026-09-17BUG/MINOR: payload: bound ClientHello extension lists by the extension length
2026-09-17BUG/MINOR: payload: fix the cipher_len bound check in smp_client_hello_parse()
2026-09-17BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames
2026-09-17BUG/MINOR: cache: Seed cache primary hash
2026-09-17BUG/MINOR: cache: Manage collisions on primary key
2026-08-26BUG/MEDIUM: sink: do not create one implicit ring per logger copy
2026-08-26BUG/MEDIUM: sink: initialize the settings of the implicit log server
2026-08-26BUG/MINOR: flt-http-comp: Don't read next block to detect end of data
2026-08-26BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters
2026-08-26BUG/MEDIUM: cache: ignore cache on redundant origin/referer
2026-08-25BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages()
2026-08-25BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch
2026-08-25BUG/MEDIUM: mux-h1: close the connection on a short content-length
2026-08-25BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd
2026-08-25BUG/MINOR: mqtt: fix PUBLISH flags validation that want all bits to be set
2026-08-25BUG/MINOR: mqtt: connack parser uses wrong bit for SUBSCRIPTION_IDENTIFIERS_AVAILABLE
2026-08-25BUG/MINOR: mqtt: connect parser uses wrong bit field for TOPIC_ALIAS_MAXIMUM
2026-08-25BUG/MINOR: mqtt: connack parser returns MQTT_NEED_MORE_DATA on unknown property
2026-08-25BUG/MINOR: cfgcond: make KQUEUE check for GTUNE_USE_KQUEUE not GTUNE_USE_EPOLL
2026-08-25BUG/MEDIUM: tools: make string encoding possible to fail instead of truncating
2026-08-25BUG/MINOR: auth: free user groups on error paths in userlist_postinit()
2026-08-25BUG/MINOR: tools: fix memory leak in env_expand() error path
2026-08-25BUG/MINOR: http-act: set-status() must check the response message, not the request
2026-08-25BUG/MINOR: http-fetch: make http_first_req() check for HTTP first
2026-08-25BUG/MINOR: http-fetch: fix smp_fetch_hdr_ip()'s handling of brackets for IPv6
2026-08-25BUG/MINOR: ot: removed dead code in flt_ot_parse_cfg_str()
2026-08-25BUG/MINOR: acme: NULL check on my_strndup()
2026-08-25BUG/MINOR: config: Check buffer pool creation for failures
2026-08-25BUG/MINOR: wurfl: fix memory leak of information list and patch strings at deinit
2026-08-25BUG/MEDIUM: mux-fcgi: check the room left before appending the index
2026-08-25BUG/MINOR: resolvers: accept fields at the response boundary
2026-08-25BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f'
2026-08-25BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy
2026-08-25BUG/MINOR: ssl: isolate TLS session resumption per crt-list filter
2026-08-25BUG/MEDIUM: ssl: isolate TLS session resumption per X509 server certificate
2026-08-25BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC
2026-08-25BUG/MEDIUM: ssl: enforce tune.ssl.lifetime across TLS1.3 session renewals
2026-08-25BUG/MEDIUM: ssl: Fix unprotected 'ssl_sock_choose_sni_ctx' calls
2026-08-25BUG/MINOR: ssl: release the previous client cert reference at depth > 0
2026-08-25BUG/MINOR: ssl: Fix leak of X509_NAME in traces
2026-08-25BUG/MINOR: conn: Do not check 'sess_el' list on frontend connections in __trace_enabled
2026-08-25BUG/MINOR: log: fix double-free error when error in parse_loger occurs
2026-08-25BUG/MINOR: qpack: missing shift count check in qpack_get_varint() (UB)
2026-08-25BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var
2026-08-25BUG/MINOR: payload: fix handshake length off-by-4 in ssl_hello_sni/alpn
2026-08-25BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode
2026-08-25BUG/MEDIUM: http: fix authority parsing for absolute-form URI with empty path
2026-08-25BUG/MINOR: server: fix off-by-one error when parsing and copying source port range
2026-08-25BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval
2026-08-25BUG/MINOR: ssl: reject an embedded NUL in the full-DN ssl_*_dn() fetches
2026-08-25BUG/MINOR: ssl: reject an embedded NUL in the ssl_*_dn(entry) fetches
2026-08-25BUG/MEDIUM: cache: do not release an entry under the cache read lock
2026-08-25BUG/MEDIUM: cache: retain the primary or secondary entry only when detaching its row
2026-08-25BUG/MEDIUM: hlua_fcn: ensure systematic bref cleanup for patref list iterator
2026-08-25BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string
2026-08-25BUG/MEDIUM: quic: prevent out-of-bound read on wrapping CRYPTO content
2026-08-25BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server
2026-08-25BUG/MINOR: debug: only dump the trace once in __BUG_ON_ONCE()
2026-08-25BUG/MINOR: lb-chash: bound the walk when the saved cursor changed tree
2026-08-25BUG/MEDIUM: session: don't release a reversed connection twice on error
2026-08-25BUG/MINOR: connection: reserve the whole CRC32C TLV before saving its pointer
2026-08-25BUG/MEDIUM: ssl: require a full-length AEAD tag when decrypting with AES-GCM
2026-08-25BUG/MINOR: acme: restrict the permissions of the generated account key
2026-08-25BUG/MINOR: ssl: reject server certificate names containing a NUL byte
2026-08-25BUG/MEDIUM: acme: don't delete a NULL token from the map
2026-08-25BUG/MEDIUM: log: always reserve room for trailing 0 when using CBOR encoding helpers
2026-08-25BUG/MINOR: mux-fcgi: sanitize the STDERR records before logging them
2026-08-25BUG/MEDIUM: http-ana: check the cookie rewrite result before moving the offsets
2026-08-25BUG/MEDIUM: sock: bound the recvmsg() length when receiving old sockets
2026-08-25BUG/MEDIUM: stick-tables: use the same bucket for string keys with a NUL
2026-08-25BUG/MEDIUM: http-ana: don't crash on "keep-query" in a response redirect
2026-08-25BUG/MINOR: mux-fcgi: don't call fcgi_strm_destroy() on a NULL stream
2026-08-25BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start
2026-08-25BUG/MINOR: hlua: use a local buffer to format the socket addresses
2026-08-25BUG/MEDIUM: hpack: encode long methods and schemes using the long form
2026-08-25BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup
2026-08-25BUG/MINOR: server: check strdup return value on server ID
2026-08-25BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering
2026-08-25BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd"

Back to the list of branches and versions
Back to the HAProxy page