MGASA-2026-0019
Updated haproxy packages fix bugs
No scoreFix available
Haproxy has two major, a few medium and a few minor bugs fixed in the last upstream version 2.8.18 of branch 2.8.
Fixed major bugs list:
- quic: use ncbmbuf for CRYPTO handling
- stream: Force channel analysis on successful synchronous send
Fixed medium bugs list:
- dns: bind the nameserver sockets to the initiating thread
- h1: prevent a crash on HTTP/2 upgrade
- h3: do not overwrite interim with final response
- h3: handle interim response properly on FE side
- h3: properly encode response after interim one in same buf
- http-ana: Don't close server connection on read0 in TUNNEL mode
- mux-quic: adjust wakeup behavior
- mux-quic: ensure Early-data header is set
- quic: CRYPTO frame freeing without eb_delete()
- resolvers: make the process_resolvers() task single-threaded
- ssl: Crash because of dangling ckch_store reference in a ckch instance
- ssl: take care of second client hello
- stick-tables: Always return the good stksess from stktable_set_entry
- stick-tables: Don't forget to dec count on failure.
What each source reports
OSV No score
Updated haproxy packages fix bugs
Haproxy has two major, a few medium and a few minor bugs fixed in the last upstream version 2.8.18 of branch 2.8.
Fixed major bugs list:
- quic: use ncbmbuf for CRYPTO handling
- stream: Force channel analysis on successful synchronous send
Fixed medium bugs list:
- dns: bind the nameserver sockets to the initiating thread
- h1: prevent a crash on HTTP/2 upgrade
- h3: do not overwrite interim with final response
- h3: handle interim response properly on FE side
- h3: properly encode response after interim one in same buf
- http-ana: Don't close server connection on read0 in TUNNEL mode
- mux-quic: adjust wakeup behavior
- mux-quic: ensure Early-data header is set
- quic: CRYPTO frame freeing without eb_delete()
- resolvers: make the process_resolvers() task single-threaded
- ssl: Crash because of dangling ckch_store reference in a ckch instance
- ssl: take care of second client hello
- stick-tables: Always return the good stksess from stktable_set_entry
- stick-tables: Don't forget to dec count on failure.
- Record
MGASA-2026-0019- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
haproxyMageia:9 |
before 2.8.18-1.mga9 | 2.8.18-1.mga9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2026-0019 is a vulnerability with no CVSS score yet in haproxy, published January 27, 2026. No source lists public exploit code. Fixed in haproxy 2.8.18-1.mga9.