Mageia alert MGASA-2026-0019 (haproxy)

From:
             
 
Mageia Updates <updates-announce@ml.mageia.org>
To:
             
 
updates-announce@ml.mageia.org
Subject:
             
 
[updates-announce] MGASA-2026-0019: Updated haproxy packages fix bugs
Date:
             
 
Tue, 27 Jan 2026 19:21:07 +0100
Message-ID:
             
 
<20260127182107.4BCEBA0DC4@duvel.mageia.org>
Archive-link:
             
 
Article
MGASA-2026-0019 - Updated haproxy packages fix bugs

Publication date: 27 Jan 2026
URL: https://advisories.mageia.org/MGASA-2026-0019.html
Type: security
Affected Mageia releases: 9

Description:
Haproxy has two major, a few medium and a few minor bugs fixed in the last
upstream version 2.8.18 of branch 2.8.

Fixed major bugs list:
- quic: use ncbmbuf for CRYPTO handling
- stream: Force channel analysis on successful synchronous send

Fixed medium bugs list:
- dns: bind the nameserver sockets to the initiating thread
- h1: prevent a crash on HTTP/2 upgrade
- h3: do not overwrite interim with final response
- h3: handle interim response properly on FE side
- h3: properly encode response after interim one in same buf
- http-ana: Don't close server connection on read0 in TUNNEL mode
- mux-quic: adjust wakeup behavior
- mux-quic: ensure Early-data header is set
- quic: CRYPTO frame freeing without eb_delete()
- resolvers: make the process_resolvers() task single-threaded
- ssl: Crash because of dangling ckch_store reference in a ckch instance
- ssl: take care of second client hello
- stick-tables: Always return the good stksess from stktable_set_entry
- stick-tables: Don't forget to dec count on failure.

References:
- https://bugs.mageia.org/show_bug.cgi?id=35064
- https://www.haproxy.org/download/2.8/src/CHANGELOG

SRPMS:
- 9/core/haproxy-2.8.18-1.mga9