Skip to content

Bump haproxy version to 3.2.23 - #977

Closed
CFN-CI wants to merge 2 commits into
masterfrom
haproxy-auto-bump-master
Closed

Bump haproxy version to 3.2.23#977
CFN-CI wants to merge 2 commits into
masterfrom
haproxy-auto-bump-master

Conversation

@CFN-CI

@CFN-CI CFN-CI commented Sep 25, 2026

Copy link
Copy Markdown
Contributor

Automatic bump from version 3.2.21 to version 3.2.23, downloaded from https://www.haproxy.org/download/3.2/src/haproxy-3.2.23.tar.gz.

After merge, consider releasing a new version of haproxy-boshrelease.

Changelog for HAProxy 3.2.23.

Please also check list of known open bugs for HAProxy 3.2.23.

The developer's summary for this release can be found in the Announcement post for the HAProxy 3.2.23 release.

HAPROXY CHANGELOG between 3.2.23 and 3.2.21 
2026/08/27 : 3.2.23
    - BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd"
    - BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering
    - BUG/MINOR: server: check strdup return value on server ID
    - BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup
    - BUG/MEDIUM: hpack: encode long methods and schemes using the long form
    - BUG/MINOR: hlua: use a local buffer to format the socket addresses
    - BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start
    - BUG/MINOR: mux-fcgi: don't call fcgi_strm_destroy() on a NULL stream
    - BUG/MEDIUM: http-ana: don't crash on "keep-query" in a response redirect
    - BUG/MEDIUM: stick-tables: use the same bucket for string keys with a NUL
    - BUG/MEDIUM: sock: bound the recvmsg() length when receiving old sockets
    - BUG/MEDIUM: http-ana: check the cookie rewrite result before moving the offsets
    - BUG/MINOR: mux-fcgi: sanitize the STDERR records before logging them
    - MINOR: log/tools: fix ambiguous comments for some log encoding helpers
    - BUG/MEDIUM: log: always reserve room for trailing 0 when using CBOR encoding helpers
    - BUG/MEDIUM: acme: don't delete a NULL token from the map
    - BUG/MINOR: ssl: reject server certificate names containing a NUL byte
    - BUG/MINOR: acme: restrict the permissions of the generated account key
    - BUG/MEDIUM: ssl: require a full-length AEAD tag when decrypting with AES-GCM
    - BUG/MINOR: connection: reserve the whole CRC32C TLV before saving its pointer
    - BUG/MEDIUM: session: don't release a reversed connection twice on error
    - BUG/MINOR: lb-chash: bound the walk when the saved cursor changed tree
    - BUG/MINOR: debug: only dump the trace once in __BUG_ON_ONCE()
    - BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server
    - BUG/MEDIUM: quic: prevent out-of-bound read on wrapping CRYPTO content
    - BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string
    - BUG/MEDIUM: hlua_fcn: ensure systematic bref cleanup for patref list iterator
    - DOC: config: clarify req.ssl_sni
    - BUG/MEDIUM: cache: retain the primary or secondary entry only when detaching its row
    - BUG/MEDIUM: cache: do not release an entry under the cache read lock
    - BUG/MINOR: ssl: reject an embedded NUL in the ssl_*_dn(entry) fetches
    - BUG/MINOR: ssl: reject an embedded NUL in the full-DN ssl_*_dn() fetches
    - BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval
    - BUG/MINOR: server: fix off-by-one error when parsing and copying source port range
    - BUG/MEDIUM: http: fix authority parsing for absolute-form URI with empty path
    - BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode
    - BUG/MINOR: payload: fix handshake length off-by-4 in ssl_hello_sni/alpn
    - BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var
    - BUG/MINOR: qpack: missing shift count check in qpack_get_varint() (UB)
    - BUG/MINOR: log: fix double-free error when error in parse_loger occurs
    - BUG/MINOR: conn: Do not check 'sess_el' list on frontend connections in __trace_enabled
    - BUG/MINOR: ssl: Fix leak of X509_NAME in traces
    - BUG/MINOR: ssl: release the previous client cert reference at depth > 0
    - BUG/MEDIUM: ssl: Fix unprotected 'ssl_sock_choose_sni_ctx' calls
    - BUG/MEDIUM: ssl: enforce tune.ssl.lifetime across TLS1.3 session renewals
    - BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC
    - BUILD: ssl: disable the TLS1.3 session timeout clamp on wolfSSL
    - BUG/MEDIUM: ssl: isolate TLS session resumption per X509 server certificate
    - BUG/MINOR: ssl: isolate TLS session resumption per crt-list filter
    - BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy
    - BUILD: ssl: avoid a potential null-dereference warning on OpenSSL 1.0.2
    - BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f'
    - BUG/MINOR: resolvers: accept fields at the response boundary
    - BUG/MEDIUM: mux-fcgi: check the room left before appending the index
    - BUG/MINOR: wurfl: fix memory leak of information list and patch strings at deinit
    - BUG/MINOR: config: Check buffer pool creation for failures
    - BUG/MINOR: acme: NULL check on my_strndup()
    - BUG/MINOR: ot: removed dead code in flt_ot_parse_cfg_str()
    - BUG/MINOR: http-fetch: fix smp_fetch_hdr_ip()'s handling of brackets for IPv6
    - BUG/MINOR: http-fetch: make http_first_req() check for HTTP first
    - BUG/MINOR: http-act: set-status() must check the response message, not the request
    - BUG/MINOR: tools: fix memory leak in env_expand() error path
    - BUG/MINOR: auth: free user groups on error paths in userlist_postinit()
    - BUG/MEDIUM: tools: make string encoding possible to fail instead of truncating
    - BUG/MINOR: cfgcond: make KQUEUE check for GTUNE_USE_KQUEUE not GTUNE_USE_EPOLL
    - BUG/MINOR: mqtt: connack parser returns MQTT_NEED_MORE_DATA on unknown property
    - BUG/MINOR: mqtt: connect parser uses wrong bit field for TOPIC_ALIAS_MAXIMUM
    - BUG/MINOR: mqtt: connack parser uses wrong bit for SUBSCRIPTION_IDENTIFIERS_AVAILABLE
    - BUG/MINOR: mqtt: fix PUBLISH flags validation that want all bits to be set
    - BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s->sd
    - BUG/MEDIUM: mux-h1: close the connection on a short content-length
    - MEDIUM: mux-h2: don't report EOM on a short content-length message
    - BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch
    - BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages()
    - MINOR: sample: add new converter has_ctl() to detect control characters
    - REGTESTS: converters: use connection: close in the has_ctl() test
    - BUG/MEDIUM: cache: ignore cache on redundant origin/referer
    - BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters
    - BUG/MINOR: flt-http-comp: Don't read next block to detect end of data
    - BUG/MEDIUM: sink: initialize the settings of the implicit log server
    - BUG/MEDIUM: sink: do not create one implicit ring per logger copy

2026/07/29 : 3.2.22
    - BUG/MEDIUM: h3: fix parser desync on error with multiple frames
    - BUG/MINOR: mux_quic: prevent multiple STOP_SENDING emission per stream
    - BUG/MEDIUM: fd: Fix a deadlock when closing other tgroups fds
    - BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size
    - BUG/MINOR: stream: Fix custom timeouts initialization when setting backend
    - BUG/MINOR: stream: Fix custom max-retries initialization when setting backend
    - BUG/MINOR: http-conv: Make url-dec failed if no space for trailing null byte
    - BUG/MINOR: hlua: Apply socket timeout on server side only
    - REORG: stconn: Move sc_chk_rcv() from sc_strm.h to stconn.c
    - BUG/MEDIUM: applet: Reenable reads in applet context if requesting a connection
    - MINOR: stats: factor the proxy vs scope check into its own function
    - BUG/MEDIUM: stats: subject "stats admin" accesses to "stats scope" filtering
    - BUG/MINOR: shctx: fix shctx_row_data_get() when offset exceeds a block
    - MINOR: shctx: clamp shctx_row_data_get() reads against the offset
    - BUG/MEDIUM: cache: reattach the row when a secondary entry is incomplete
    - BUG/MEDIUM: stats: Ensure that Origin is valid on POSTs
    - DOC: stats: Document that stats admin is vulnerable to a CSRF attack
    - BUG/MEDIUM: ssl-gencert: Don't forget to free memory when done
    - BUG/MEDIUM: protobuf: adjust sample size capacity after pointer shift
    - BUG/MEDIUM: protobuf: fix nested path bypass in field lookup
    - BUG/MINOR: ssl: fix proxy lookup for show ssl sni
    - REGTESTS: protobuf: add regression test for nested vs flat paths
    - BUG/MINOR: mux-h1: Don't delay send if message with c-l was fully sent
    - BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes()
    - BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for ltrim()
    - BUG/MINOR: sample: Fix bytes() when length it greater than remaining data
    - BUG/MEDIUM: proxy: protect "show servers ..." against server deletion
    - BUG/MINOR: resolvers: do not index resolvers names in the proxies
    - REORG: h1-htx: Move h1 headers map in h1-htx
    - BUG/MEDIUM: mux-h1: Always adjust case for all outgoing headers as expected
    - BUG/MINOR: http-htx: fix the length moved when removing a header value
    - BUG/MEDIUM: http-fetch: don't parse a non-HTTP check buffer as an HTX message
    - BUG/MEDIUM: http-fetch: reject a negative capture id in capture.{req,res}.hdr
    - BUG/MINOR: http: fix an out-of-bounds read in http_get_host_port() on empty host
    - BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize()
    - BUG/MINOR: h1: report the right error position on authority/host mismatch
    - BUG/MINOR: h2: don't use a block pointer to roll back a partial HTX conversion
    - BUG/MINOR: http-ana: fix a one-byte over-read in the client-side cookie parser
    - BUG/MINOR: http-act: fix a double free of the regex on a rule parsing error
    - BUG/MINOR: http-act: fix a double free of the map reference on a parsing error
    - BUG/MINOR: http-act: restore the response buffer state in the early-hint action
    - BUG/MINOR: http-act: reject a negative capture id in the capture actions
    - BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument
    - BUG/MINOR: htx: Perform raw copy for messages of same size in htx_copy_msg()
    - BUG/MINOR: htx: Transfer HTX_FL_EOM flag on success in htx_append_msg()
    - BUG/MINOR: http-rules: fix release of a failed "set-cookie-fmt" redirect rule
    - BUG/MINOR: slz: do not read past the end of the input around the match loop
    - CLEANUP: slz: fix the documented worst case size of flush() and finish()
    - BUG/MINOR: slz: use the exact switch cost for the last literals of a block
    - BUG/MEDIUM: slz: bound the bits wasted by the 9-bit literals
    - BUG/MINOR: slz: do not append a block to an already finished stream
    - BUG/MINOR: slz: fix the adler32 accumulators signedness on 32-bit
    - BUG/MINOR: slz: avoid undefined shifts when building the word byte by byte
    - CLEANUP: slz: clarify that the size promise applies to the stream, not to a call
    - BUG/MEDIUM: peers: check the available room before encoding dict values
    - BUG/MEDIUM: sample: reject the deprecated protobuf group wire types
    - BUG/MAJOR: ssl/ocsp: lock the OCSP response around reads in the stapling callback
    - MEDIUM: stream: Introduce stream_set_srv_target()
    - BUG/MEDIUM: server: Properly check for streams before deletion
    - MINOR: server: improve parsing error for server-template
    - BUG/MINOR: server: duplicate server alt_proto in srv_settings_cpy()
    - BUG/MINOR: server: fix check reuse-pool in srv_settings_cpy()

@CFN-CI
CFN-CI requested a review from a team as a code owner September 25, 2026 05:03
@CFN-CI CFN-CI added the run-ci Allow this PR to be tested on Concourse label Sep 25, 2026
hoffmaen
hoffmaen requested changes Sep 25, 2026
View reviewed changes

@hoffmaen hoffmaen left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do not merge - see #976

@hoffmaen hoffmaen added do not merge and removed run-ci Allow this PR to be tested on Concourse labels Sep 25, 2026
@b1tamara b1tamara closed this Sep 30, 2026
@CFN-CI
CFN-CI deleted the haproxy-auto-bump-master branch September 30, 2026 06:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hoffmaen hoffmaen hoffmaen requested changes

Assignees

No one assigned

Labels

do not merge

Projects

Application Runtime Platform Working Group
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@CFN-CI @hoffmaen @b1tamara