{"id":"MGASA-2026-0019","aliases":[],"status":"published","title":"Updated haproxy packages fix bugs","description":"Haproxy has two major, a few medium and a few minor bugs fixed in the last\nupstream version 2.8.18 of branch 2.8.\n\nFixed major bugs list:\n- quic: use ncbmbuf for CRYPTO handling\n- stream: Force channel analysis on successful synchronous send\n\nFixed medium bugs list:\n- dns: bind the nameserver sockets to the initiating thread\n- h1: prevent a crash on HTTP/2 upgrade\n- h3: do not overwrite interim with final response\n- h3: handle interim response properly on FE side\n- h3: properly encode response after interim one in same buf\n- http-ana: Don't close server connection on read0 in TUNNEL mode\n- mux-quic: adjust wakeup behavior\n- mux-quic: ensure Early-data header is set\n- quic: CRYPTO frame freeing without eb_delete()\n- resolvers: make the process_resolvers() task single-threaded\n- ssl: Crash because of dangling ckch_store reference in a ckch instance\n- ssl: take care of second client hello\n- stick-tables: Always return the good stksess from stktable_set_entry\n- stick-tables: Don't forget to dec count on failure.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-01-27T18:20:27Z","modified":"2026-04-16T04:20:02Z","fixes":[{"ecosystem":"Mageia:9","package":"haproxy","fixed_in":["2.8.18-1.mga9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:9","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.18-1.mga9"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2026-0019.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35064","tags":["report"]},{"url":"https://www.haproxy.org/download/2.8/src/CHANGELOG","tags":["web"]}],"sources":{"osv":[{"id":"MGASA-2026-0019","title":"Updated haproxy packages fix bugs","description":"Haproxy has two major, a few medium and a few minor bugs fixed in the last\nupstream version 2.8.18 of branch 2.8.\n\nFixed major bugs list:\n- quic: use ncbmbuf for CRYPTO handling\n- stream: Force channel analysis on successful synchronous send\n\nFixed medium bugs list:\n- dns: bind the nameserver sockets to the initiating thread\n- h1: prevent a crash on HTTP/2 upgrade\n- h3: do not overwrite interim with final response\n- h3: handle interim response properly on FE side\n- h3: properly encode response after interim one in same buf\n- http-ana: Don't close server connection on read0 in TUNNEL mode\n- mux-quic: adjust wakeup behavior\n- mux-quic: ensure Early-data header is set\n- quic: CRYPTO frame freeing without eb_delete()\n- resolvers: make the process_resolvers() task single-threaded\n- ssl: Crash because of dangling ckch_store reference in a ckch instance\n- ssl: take care of second client hello\n- stick-tables: Always return the good stksess from stktable_set_entry\n- stick-tables: Don't forget to dec count on failure.\n","status":"published","published":"2026-01-27T18:20:27Z","modified":"2026-04-16T04:20:02.23798Z","updated_at":"2026-11-02T15:49:43.178336Z"}]}}