USN-8972-2: HAProxy patch on Ubuntu 22.04 was causing 502 errors on chunked responses

Anyone who updated HAProxy on Ubuntu 22.04 LTS after 3 November and saw 502 errors appearing repeatedly on chunked responses hadn't misconfigured anything: it was a bug in the security patch. Ubuntu confirmed this on 5 November 2026 with advisory USN-8972-2.

What happened

On 3 November, Ubuntu released USN-8972-1 to fix two vulnerabilities in HAProxy: HAProxy incorrectly handled certain HTTP/1.1 chunked requests, and a remote attacker could exploit the issue to cause excessive CPU resource consumption, resulting in denial of service (CVE-2026-110354). The other vulnerability, CVE-2026-110353, concerned the incorrect handling of truncated HTTP/2 PING frames, with the same risk of CPU exhaustion.

The package 2.4.30-0ubuntu0.22.04.3 for jammy patched the CVEs but introduced a new problem. According to the bug report on Launchpad, HTTP/1.1 responses with Transfer-Encoding: chunked header were being truncated at a fixed byte offset for each URL, with HTTP/1.1 chunked backend responses cut at a fixed byte offset per URL after installing the .3 version. Those running reverse proxies in front of Tomcat backends were among the most affected, because the impacted requests are POST responses that Tomcat sends with Transfer-Encoding: chunked. HAProxy logs showed the error "PH--", and in some environments the proportion of failed requests represented a significant share of traffic.

What changes with version 2.4.30-0ubuntu0.22.04.4

Today's advisory, USN-8972-2, closes the regression: on the 22.04 LTS jammy release, the corrected package is haproxy 2.4.30-0ubuntu0.22.04.4. In the official package changelog, the fix is described as an update to the CVE-2026-110354 patch that now correctly validates the source buffer ("srcbuf") before processing chunks.

The issue only affected Ubuntu 22.04 LTS: the other releases covered by the original advisory, 26.10, 26.04 LTS and 24.04 LTS, did not experience the regression.

What to do

Running apt update && apt install haproxy on jammy brings the corrected version. Anyone who had already installed the .3 version and noticed intermittent 502 errors on backends with chunked responses can verify the version with dpkg -l haproxy and update immediately: no configuration changes are needed, the fix is entirely in the package.