HAProxy known bugs for maintenance branch 3.2 :  34 

This is maintenance branch 3.2 whose latest version is 3.2.23. If your version is not the last one in the maintenance branch, you are missing fixes for known bugs, and by not updating you are needlessly taking the responsibility for the risk of unexpected service outages and exposing your web site to possible security issues.

The HAProxy development team takes a great care of maintaining stable versions so that all users can apply bug fixes without having to take the risk of upgrading to a new branch. In turn users are expected to apply the fixes when the development team estimates that they were worth being backported to stable branches. In short, if you are running any 3.2 version other than 3.2.23, you're running with known bugs.

Quick links

Versions available in this branch

This branch contains the following releases :

DateVersionComment
2026-08-273.2.23 ⇐ last
2026-07-293.2.22 
2026-07-033.2.21 
2026-06-263.2.20 
2026-05-113.2.19 
2026-05-063.2.18 
2026-04-303.2.17 
2026-04-233.2.16 
2026-03-193.2.15 
2026-03-093.2.14 
2026-02-193.2.13 
2026-02-123.2.12 
2026-01-293.2.11 
2025-12-183.2.10 
2025-11-213.2.9 
2025-11-073.2.8 
2025-10-233.2.7 
2025-10-033.2.6 
2025-09-233.2.5 
2025-08-133.2.4 
2025-07-093.2.3 
2025-07-023.2.2 
2025-06-113.2.1 
2025-05-283.2.0 

Fixes for known bugs pending in this branch since the last release (3.2.23)

These fixes have already been queued for the next 3.2 release but no version was released with them yet. Note that fixes are backported several at a time from the development branch to maintenance branches, and the absence of a fix here doesn't mean none will be issued soon.

Bugs are almost always tagged with a severity (some people forget the severity tag when the bug is minor). The following severities are used :

Total known bugs in the latest version of this branch by category :

TotalCRITICALMAJORMEDIUMMINOR
34 0 1 14 19

Click on the subjects below to get the full description of the bug :

Merge dateSubject - Severity (minor, medium, major, critical)
2026-09-17BUG/MEDIUM: mux_quic: do not free QCS if STOP_SENDING to sent
2026-09-17BUG/MEDIUM: limits: properly account for global.maxpipes in compute_ideal_maxconn()
2026-09-17BUG/MEDIUM: tcp-rules: Don't restart tcp-request content evaluation on yield
2026-09-17BUG/MEDIUM: htx: Reserve a block descriptor for zero-sized blocks
2026-09-17BUG/MEDIUM: ssl: don't set a 0 timeout on an expired TLS session
2026-09-17BUG/MINOR: sample: reject a \0 byte in url_dec, json_query and jwt_*_query
2026-09-17BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry
2026-09-17BUG/MEDIUM: cli: Don't read a command or payload line into a full buffer
2026-09-17BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a condition
2026-09-17BUG/MEDIUM: map: do not overwrite the fetch context in pat_match_regm()
2026-09-17BUG/MINOR: ssl: don't pass the address of a size_t as an int* to OpenSSL
2026-09-17BUG/MEDIUM: http-ana: apply tunnel timeout with data filters
2026-09-17BUG/MINOR: h3: only increment frame type counter on new header
2026-09-17BUG/MINOR: h3: handle unknown frame type on request stream as specified
2026-09-17BUG/MINOR: h3: handle empty HEADERS frame as specified
2026-09-17BUG/MEDIUM: h3: do not block FIN on empty DATA frame
2026-09-17BUG/MINOR: stream/debug: harden the stream dump function regarding signals
2026-09-17BUG/MINOR: hlua: Always return nil if there is no data to dup for HTTP messages
2026-09-17BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished
2026-09-17BUG/MEDIUM: hlua: Never release a cosocket applet from the GC
2026-09-17BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure
2026-09-17BUG/MAJOR: h3: reject H3 truncated frames
2026-09-17BUG/MEDIUM: mux-h2: Make sure we remove H2_SF_NOTIFIED on subscribe
2026-09-17BUG/MINOR: quic: delete the wrong CIDs when post-handshake frames fail
2026-09-17BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached
2026-09-17BUG/MINOR: qpack: encoder and decoder stream data is never consumed
2026-09-17BUG/MINOR: resolvers: classify empty truncated responses
2026-09-17BUG/MINOR: quic: late packets of the first key phase are dropped
2026-09-17BUG/MEDIUM: quic: crash on key update phase change after a failed one
2026-09-17BUG/MINOR: payload: bound ClientHello extension lists by the extension length
2026-09-17BUG/MINOR: payload: fix the cipher_len bound check in smp_client_hello_parse()
2026-09-17BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames
2026-09-17BUG/MINOR: cache: Seed cache primary hash
2026-09-17BUG/MINOR: cache: Manage collisions on primary key

Known bugs fixed in the development branch after the last commit in this branch

It is important to understand that not all of these commits are necessarily relevant to this version, but clicking on them will show the bug description. All fixes are made first in the development branch and then backported to the maintenance branches. This ensures no fix is lost when upgrading. If a fix was marked for backporting to this branch and is not there yet, it's likely that it is still missing. Do not hesitate to ask on the haproxy mailing list if you feel like a fix has been skipped.

DateSubject
2026-09-18BUG/MINOR: mux-h2: Reject trailers received on a tunneled stream
2026-09-18BUG/MAJOR: htx: Check the header/trailer length limits when one is updated
2026-09-18BUG/MINOR: tools: Don't try to anonymize a NULL string
2026-09-18BUG/MEDIUM: htx: Fix the position returned by htx_defrag()
2026-09-18BUG/MINOR: ssl/ocsp: Report an error when an empty OCSP response is received
2026-09-18BUG/MEDIUM: http-client/cli: Notify the http-client when the response is consumed
2026-09-18BUG/MEDIUM: acme: Set HTTPCLIENT_O_RES_ACCUM option on the http-client
2026-09-18BUG/MEDIUM: ssl/ocsp: Set HTTPCLIENT_O_RES_ACCUM option on the http-client
2026-09-18BUG/MEDIUM: http-client: Don't use the httpclient context if it was released
2026-09-18BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy

Back to the list of branches and versions
Back to the HAProxy page