Amaury Denoyelle 8e16fd2cf1 BUG/MAJOR: quic: fix parsing frame type ...

QUIC frame type is encoded as a varint. Initially, haproxy parsed it as
a single byte, which was enough to cover frames defined in RFC9000.

The code has been extended recently to support multi-bytes encoded
value, in anticipation of QUIC frames extension support. However, there
was no check on the varint format. This is interpreted erroneously as a
PADDING frame as this serves as the initial value. Thus the rest of the
packet is incorrectly handled, with various resulting effects, including
infinite loops and/or crashes.

This patch fixes this by checking the return value of quic_dec_int(). If
varint cannot be parsed, the connection is immediately closed.

This issue is assigned to CVE-2026-26080 report.

This must be backported up to 3.2.

Reported-by: Asim Viladi Oglu Manizada <manizada@pm.me>

2026-02-12 09:09:44 +01:00

..

_ceb_addr.c

…

_ceb_blk.c

…

_ceb_int.c

…

_ceb_str.c

…

acl.c

…

acme.c

…

action.c

…

activity.c

MINOR: activity: allow to switch per-task lock/memory profiling at runtime

2026-02-10 17:53:01 +01:00

applet.c

…

arg.c

…

auth.c

…

backend.c

MINOR: backend: add function to check support for dynamic servers

2026-02-06 14:35:19 +01:00

base64.c

…

buf.c

…

cache.c

…

calltrace.c

…

ceb32_tree.c

…

ceb64_tree.c

…

ceba_tree.c

…

cebb_tree.c

…

cebib_tree.c

…

cebis_tree.c

…

cebl_tree.c

…

cebs_tree.c

…

cebtree-dbg.c

…

cebtree-prv.h

…

cfgcond.c

…

cfgdiag.c

…

cfgparse-global.c

…

cfgparse-listen.c

MINOR: proxy: parse mode on dynamic backend creation

2026-02-06 17:27:50 +01:00

cfgparse-peers.c

…

cfgparse-quic.c

…

cfgparse-ssl.c

…

cfgparse-tcp.c

…

cfgparse-unix.c

…

cfgparse.c

MINOR: proxy: assign dynamic proxy ID

2026-02-06 17:28:27 +01:00

channel.c

…

check.c

…

chunk.c

…

cli.c

…

clock.c

…

compression.c

…

connection.c

…

counters.c

…

cpu_topo.c

…

cpuset.c

…

debug.c

…

dgram.c

…

dict.c

…

dns_ring.c

…

dns.c

…

dynbuf.c

…

eb32sctree.c

…

eb32tree.c

…

eb64tree.c

…

ebimtree.c

…

ebistree.c

…

ebmbtree.c

…

ebsttree.c

…

ebtree.c

…

ech.c

…

errors.c

…

ev_epoll.c

…

ev_evports.c

…

ev_kqueue.c

…

ev_poll.c

…

ev_select.c

…

event_hdl.c

…

extcheck.c

…

fcgi-app.c

…

fcgi.c

…

fd.c

…

filters.c

…

fix.c

…

flt_bwlim.c

…

flt_http_comp.c

…

flt_spoe.c

…

flt_trace.c

…

freq_ctr.c

…

frontend.c

…

guid.c

…

h1_htx.c

…

h1.c

…

h2.c

…

h3_stats.c

…

h3.c

…

haproxy.c

CLEANUP: haproxy: fix bad line wrapping in run_poll_loop()

2026-02-10 14:11:42 +01:00

hash.c

…

hlua_fcn.c

…

hlua.c

…

hpack-dec.c

…

hpack-enc.c

…

hpack-huff.c

…

hpack-tbl.c

…

hq_interop.c

…

http_acl.c

…

http_act.c

…

http_ana.c

…

http_client.c

…

http_conv.c

…

http_ext.c

…

http_fetch.c

…

http_htx.c

…

http_rules.c

…

http.c

…

httpclient_cli.c

…

htx.c

…

init.c

…

jwe.c

…

jws.c

…

jwt.c

…

lb_chash.c

BUG/MEDIUM: lb-chash: always properly initialize lb_nodes with dynamic servers

2026-02-10 07:22:54 +01:00

lb_fas.c

…

lb_fwlc.c

…

lb_fwrr.c

…

lb_map.c

…

lb_ss.c

…

limits.c

…

linuxcap.c

…

listener.c

…

log.c

…

lru.c

…

mailers.c

…

map.c

…

mjson.c

…

mqtt.c

…

mux_fcgi.c

…

mux_h1.c

…

mux_h2.c

…

mux_pt.c

…

mux_quic.c

…

mux_spop.c

…

mworker.c

…

namespace.c

…

ncbmbuf.c

…

ncbuf.c

…

net_helper.c

MINOR: net_helper: extend the ip.fp output with an option presence mask

2026-02-09 09:18:04 +01:00

pattern.c

…

payload.c

…

peers.c

…

pipe.c

…

pool.c

MEDIUM: activity: apply and use new finegrained task profiling settings

2026-02-10 17:52:59 +01:00

proto_quic.c

…

proto_rhttp.c

…

proto_sockpair.c

…

proto_tcp.c

…

proto_udp.c

…

proto_uxdg.c

…

proto_uxst.c

…

protocol.c

…

proxy.c

BUG/MINOR: proxy: fix default ALPN bind settings

2026-02-09 13:52:25 +01:00

qmux_http.c

…

qmux_trace.c

…

qpack-dec.c

…

qpack-enc.c

…

qpack-tbl.c

…

queue.c

MINOR: queues: Check minconn first in srv_dynamic_maxconn()

2026-02-12 02:18:59 +01:00

quic_ack.c

…

quic_cc_bbr.c

…

quic_cc_cubic.c

…

quic_cc_drs.c

…

quic_cc_newreno.c

…

quic_cc_nocc.c

…

quic_cc.c

…

quic_cid.c

…

quic_cli.c

…

quic_conn.c

…

quic_enc.c

…

quic_fctl.c

…

quic_frame.c

BUG/MAJOR: quic: fix parsing frame type

2026-02-12 09:09:44 +01:00

quic_loss.c

…

quic_openssl_compat.c

…

quic_pacing.c

…

quic_retransmit.c

…

quic_retry.c

…

quic_rules.c

…

quic_rx.c

BUG/MINOR: quic: ensure handshake speed up is only run once per conn

2026-02-12 09:09:44 +01:00

quic_sock.c

…

quic_ssl.c

…

quic_stats.c

…

quic_stream.c

…

quic_tls.c

…

quic_token.c

BUG/MAJOR: quic: reject invalid token

2026-02-12 09:09:44 +01:00

quic_tp.c

…

quic_trace.c

…

quic_tx.c

…

raw_sock.c

…

regex.c

…

resolvers.c

…

ring.c

…

sample.c

…

server_state.c

…

server.c

MINOR: servers: Call process_srv_queue() without lock when possible

2026-02-12 02:19:38 +01:00

session.c

…

sha1.c

…

shctx.c

…

signal.c

…

sink.c

…

slz.c

…

sock_inet.c

…

sock_unix.c

…

sock.c

…

ssl_ckch.c

BUG/MINOR: ssl: SSL_CERT_DIR environment variable doesn't affect haproxy

2026-02-10 21:34:45 +01:00

ssl_clienthello.c

…

ssl_crtlist.c

…

ssl_gencert.c

…

ssl_ocsp.c

…

ssl_sample.c

…

ssl_sock.c

BUG/MINOR: ssl: SSL_CERT_DIR environment variable doesn't affect haproxy

2026-02-10 21:34:45 +01:00

ssl_trace.c

…

ssl_utils.c

…

stats-file.c

…

stats-html.c

…

stats-json.c

…

stats-proxy.c

…

stats.c

…

stconn.c

…

stick_table.c

…

stream.c

…

systemd.c

…

task.c

…

tcp_act.c

…

tcp_rules.c

…

tcp_sample.c

…

tcpcheck.c

…

thread.c

…

time.c

…

tools.c

…

trace.c

…

uri_auth.c

…

uri_normalizer.c

…

vars.c

…

version.c

…

wdt.c

…

xprt_handshake.c

…

xprt_quic.c

…