HAProxy known bugs for version v2.8.21 (maintenance branch 2.8) : 47

This version (2.8.21) is a release belonging to maintenance branch 2.8 whose latest version is 2.8.24. If your version is not the last one in the maintenance branch, you are missing fixes for known bugs, and by not updating you are needlessly taking the responsibility for the risk of unexpected service outages and exposing your web site to possible security issues.

The HAProxy development team takes a great care of maintaining stable versions so that all users can apply bug fixes without having to take the risk of upgrading to a new branch. In turn users are expected to apply the fixes when the development team estimates that they were worth being backported to stable branches.

Quick links

full changelog for 2.8 : here
browse history for 2.8 : here

Other versions in the same branch

This branch contains the following releases :

Date Version Comment

2026-05-11 2.8.24 ⇐ last

2026-05-06 2.8.23

2026-04-30 2.8.22

2026-04-23 2.8.21 ⇐ yours

2026-03-20 2.8.20

2026-03-09 2.8.19

2025-12-25 2.8.18

2025-12-19 2.8.17

2025-10-03 2.8.16

2025-04-22 2.8.15

2025-01-29 2.8.14

2024-12-12 2.8.13

2024-11-08 2.8.12

2024-09-19 2.8.11

2024-06-14 2.8.10

2024-04-05 2.8.9

2024-04-05 2.8.8

2024-02-26 2.8.7

2024-02-15 2.8.6

2023-12-07 2.8.5

2023-11-17 2.8.4

2023-09-07 2.8.3

2023-08-09 2.8.2

2023-07-03 2.8.1

2023-05-31 2.8.0

Date	Version	Comment
2026-05-11	2.8.24	⇐ last
2026-05-06	2.8.23
2026-04-30	2.8.22
2026-04-23	2.8.21	⇐ yours
2026-03-20	2.8.20
2026-03-09	2.8.19
2025-12-25	2.8.18
2025-12-19	2.8.17
2025-10-03	2.8.16
2025-04-22	2.8.15
2025-01-29	2.8.14
2024-12-12	2.8.13
2024-11-08	2.8.12
2024-09-19	2.8.11
2024-06-14	2.8.10
2024-04-05	2.8.9
2024-04-05	2.8.8
2024-02-26	2.8.7
2024-02-15	2.8.6
2023-12-07	2.8.5
2023-11-17	2.8.4
2023-09-07	2.8.3
2023-08-09	2.8.2
2023-07-03	2.8.1
2023-05-31	2.8.0

Known bugs affecting this version, and already fixed in the maintenance branch

These fixes have already been queued for a more recent 2.8 version. Some of them might have already been released in a more recent version than yours, and other ones might still be pending in the maintenance branch for a future release. The list may be empty if you're already on the latest version and no new fix was backported.

Bugs are almost always tagged with a severity (some people forget the severity tag when the bug is minor). The following severities are used :

MINOR: the bug presents a limited impact and can easily be mitigated ; users rarely upgrade just for these ones ;
MEDIUM: the bug can cause some undesired behaviour and may require some tricky configuration changes to avoid hitting it ; users normally upgrade to get rid of them, or temporarily disable a functionality.
MAJOR: the bug affects short term reliability and cannot easily be worked around without a significant performance penalty or without a significant functional loss ; such bugs don't stay long in the queue without a release and users must plan an upgrade as soon as possible ;
CRITICAL: this one very rarely happens ; it indicates a short-term reliability or security issue for which there is no workaround. A release will be emitted for this fix even if it's alone and users are urged to upgrade immediately. Some distro maintainers might have been informed in advance in order to agree on a coordinated release date.

Total known bugs in this version by category :

Total CRITICAL MAJOR MEDIUM MINOR

47 0 3 18 26

Total	CRITICAL	MAJOR	MEDIUM	MINOR
47	0	3	18	26

Click on the subjects below to get the full description of the bug :

Merge date Subject - Severity (minor, medium, major, critical)

2026-05-21 BUG/MINOR: h1: Don't mask websocket protocol if multiple protocols used

2026-05-21 BUG/MEDIUM: h1: Skip all h2c values from Upgrade headers during parsing

2026-05-21 BUG/MINOR: httpclient-cli: Destroy http-client context if failing to start it

2026-05-21 BUG/MINOR: jwt: fix possible memory leak in convert_ecdsa_sig() error path

2026-05-21 BUG/MINOR: check: properly report errno in chk_report_conn_err()

2026-05-21 BUG/MINOR: resolvers: report the expression error in the do-resolve() action parser

2026-05-21 BUG/MINOR: dns: fix dangling dgram pointer on dns_dgram_init() failure path

2026-05-21 BUG/MEDIUM: dns: fix memory leak of sockaddr in dns_session_init() error path

2026-05-21 BUG/MEDIUM: resolvers: fix name compression pointer validation in resolv_read_name()

2026-05-21 BUG/MEDIUM: dns: fix long loops in additional records parse on name failure

2026-05-21 BUG/MINOR: config/dns: properly fail on duplicate nameserver name detection

2026-05-21 BUG/MINOR: backend: correct parameter value validation in get_server_ph_post()

2026-05-21 BUG/MEDIUM: dict: hold read lock while incrementing refcount in dict_insert

2026-05-21 BUG/MEDIUM: mux_quic: adjust qcc_is_dead() to account detached streams

2026-05-11 BUG/MEDIUM: tasks: Keep the TASK_RUNNING flag until queued

2026-05-11 BUG/MINOR: cfgparse-listen: do not emit extraneous line in rule order warnings

2026-05-07 BUG/MEDIUM: stick-table: properly check permissions on CLI's set/clear cmd

2026-05-07 BUG/MEDIUM: mux-h2: fix the detection of the ext connect support

2026-05-07 Revert "BUG/MINOR: mux-h2: condition the processing of 8441 extension to global setting"

2026-05-07 Revert "BUG/MEDIUM: cli: fix master CLI connection slot leak on client disconnect"

2026-05-07 BUG/MEDIUM: mux-h2: Properly consume padding for DATA frames

2026-05-06 BUG/MEDIUM: h1: Enforce the authority validation during H1 request parsing

2026-05-06 BUG/MAJOR: http: forbid comma character in authority value

2026-05-06 BUG/MEDIUM: h1_htx: Remove reverved block on error during contig chunks parsing

2026-05-06 BUG/MINOR: http-fetch: Fix http_auth_bearer() when custom header is used

2026-05-06 BUG/MINOR: h2: only accept :protocol with extended CONNECT

2026-05-06 BUG/MINOR: mux-h2: condition the processing of 8441 extension to global setting

2026-05-06 BUG/MINOR: h2: add decoding for :protocol in traces

2026-05-04 BUG/MEDIUM: cli: fix master CLI connection slot leak on client disconnect

2026-05-04 BUG/MINOR: mworker/cli: check ci_insert() return value in pcli_parse_request()

2026-05-04 BUG/MINOR: resolvers: Free opts on parse error in resolv_parse_do_resolve()

2026-05-04 BUG/MINOR: resolvers: Free new requester on error when linking a resolution

2026-05-04 BUG/MINOR: tcpcheck: Properly report error for http health-checks

2026-05-04 BUG/MAJOR: mux-h2: preset MSGF_BODY_CL on H2_SF_DATA_CLEN in h2c_dec_hdrs()

2026-05-04 BUG/MEDIUM: mux-h2: fix the body_len to check when parsing request trailers

2026-05-04 BUG/MINOR: map: do not leak a map descriptor on load error

2026-05-04 BUG/MINOR: hpack: validate idx > 0 in hpack_valid_idx()

2026-05-04 BUG/MINOR: vars: only print first invalid char in fill_desc()

2026-05-04 BUG/MINOR: vars: don't store the variable twice with set-var-fmt

2026-05-04 BUG/MINOR: vars: make parse_store() return error on var_set() failure

2026-04-30 BUG/MINOR: http-htx: Don't normalize emtpy path for OPTIONS requests

2026-04-29 BUG/MEDIUM: mux-fcgi: Properly handle full buffer for FCGI_PARAM record

2026-04-29 BUG/MINOR: payload: prevent integer overflow in distcc token parsing

2026-04-29 BUG/MEDIUM: tasks: Do not loop in task_schedule() if a task is running

2026-04-29 BUG/MEDIUM: http-htx: Loop on full host value during scheme based normalization

2026-04-29 BUG/MEDIUM: http-htx: Don't use data from HTX message to update authority

2026-04-29 BUG/MAJOR: http-htx: Store new host in a chunk for scheme-based normalization

2026-04-29 BUG/MINOR: tools: fix memory leak in indent_msg() on out of memory

2026-04-29 BUG/MINOR: tools: my_memspn/my_memcspn wrong cast causing incorrect byte reading

Merge date	Subject - Severity (minor, medium, major, critical)
2026-05-21	BUG/MINOR: h1: Don't mask websocket protocol if multiple protocols used
2026-05-21	BUG/MEDIUM: h1: Skip all h2c values from Upgrade headers during parsing
2026-05-21	BUG/MINOR: httpclient-cli: Destroy http-client context if failing to start it
2026-05-21	BUG/MINOR: jwt: fix possible memory leak in convert_ecdsa_sig() error path
2026-05-21	BUG/MINOR: check: properly report errno in chk_report_conn_err()
2026-05-21	BUG/MINOR: resolvers: report the expression error in the do-resolve() action parser
2026-05-21	BUG/MINOR: dns: fix dangling dgram pointer on dns_dgram_init() failure path
2026-05-21	BUG/MEDIUM: dns: fix memory leak of sockaddr in dns_session_init() error path
2026-05-21	BUG/MEDIUM: resolvers: fix name compression pointer validation in resolv_read_name()
2026-05-21	BUG/MEDIUM: dns: fix long loops in additional records parse on name failure
2026-05-21	BUG/MINOR: config/dns: properly fail on duplicate nameserver name detection
2026-05-21	BUG/MINOR: backend: correct parameter value validation in get_server_ph_post()
2026-05-21	BUG/MEDIUM: dict: hold read lock while incrementing refcount in dict_insert
2026-05-21	BUG/MEDIUM: mux_quic: adjust qcc_is_dead() to account detached streams
2026-05-11	BUG/MEDIUM: tasks: Keep the TASK_RUNNING flag until queued
2026-05-11	BUG/MINOR: cfgparse-listen: do not emit extraneous line in rule order warnings
2026-05-07	BUG/MEDIUM: stick-table: properly check permissions on CLI's set/clear cmd
2026-05-07	BUG/MEDIUM: mux-h2: fix the detection of the ext connect support
2026-05-07	Revert "BUG/MINOR: mux-h2: condition the processing of 8441 extension to global setting"
2026-05-07	Revert "BUG/MEDIUM: cli: fix master CLI connection slot leak on client disconnect"
2026-05-07	BUG/MEDIUM: mux-h2: Properly consume padding for DATA frames
2026-05-06	BUG/MEDIUM: h1: Enforce the authority validation during H1 request parsing
2026-05-06	BUG/MAJOR: http: forbid comma character in authority value
2026-05-06	BUG/MEDIUM: h1_htx: Remove reverved block on error during contig chunks parsing
2026-05-06	BUG/MINOR: http-fetch: Fix http_auth_bearer() when custom header is used
2026-05-06	BUG/MINOR: h2: only accept :protocol with extended CONNECT
2026-05-06	BUG/MINOR: mux-h2: condition the processing of 8441 extension to global setting
2026-05-06	BUG/MINOR: h2: add decoding for :protocol in traces
2026-05-04	BUG/MEDIUM: cli: fix master CLI connection slot leak on client disconnect
2026-05-04	BUG/MINOR: mworker/cli: check ci_insert() return value in pcli_parse_request()
2026-05-04	BUG/MINOR: resolvers: Free opts on parse error in resolv_parse_do_resolve()
2026-05-04	BUG/MINOR: resolvers: Free new requester on error when linking a resolution
2026-05-04	BUG/MINOR: tcpcheck: Properly report error for http health-checks
2026-05-04	BUG/MAJOR: mux-h2: preset MSGF_BODY_CL on H2_SF_DATA_CLEN in h2c_dec_hdrs()
2026-05-04	BUG/MEDIUM: mux-h2: fix the body_len to check when parsing request trailers
2026-05-04	BUG/MINOR: map: do not leak a map descriptor on load error
2026-05-04	BUG/MINOR: hpack: validate idx > 0 in hpack_valid_idx()
2026-05-04	BUG/MINOR: vars: only print first invalid char in fill_desc()
2026-05-04	BUG/MINOR: vars: don't store the variable twice with set-var-fmt
2026-05-04	BUG/MINOR: vars: make parse_store() return error on var_set() failure
2026-04-30	BUG/MINOR: http-htx: Don't normalize emtpy path for OPTIONS requests
2026-04-29	BUG/MEDIUM: mux-fcgi: Properly handle full buffer for FCGI_PARAM record
2026-04-29	BUG/MINOR: payload: prevent integer overflow in distcc token parsing
2026-04-29	BUG/MEDIUM: tasks: Do not loop in task_schedule() if a task is running
2026-04-29	BUG/MEDIUM: http-htx: Loop on full host value during scheme based normalization
2026-04-29	BUG/MEDIUM: http-htx: Don't use data from HTX message to update authority
2026-04-29	BUG/MAJOR: http-htx: Store new host in a chunk for scheme-based normalization
2026-04-29	BUG/MINOR: tools: fix memory leak in indent_msg() on out of memory
2026-04-29	BUG/MINOR: tools: my_memspn/my_memcspn wrong cast causing incorrect byte reading

Back to the list of branches and versions
Back to the HAProxy page