Regression in Ubuntu 22.04 HAProxy security update: HTTP/1.1 chunked responses cause 502 Bad Gateway
Package: haproxy
Ubuntu release: 22.04 LTS (Jammy)
Working package: 2.4.30-0ubuntu0.22.04.2
Affected package: 2.4.30-0ubuntu0.22.04.3
Related security notice: USN-8972-1
Suggested tag: regression-update
Summary
After upgrading HAProxy from package revision .2 to .3 on 4 November 2026, multiple production ASP.NET Core applications (.NET 8, 9 and 10) began returning HTTP 502 Bad Gateway through HAProxy.
Older ASP.NET Framework applications remained functional.
The issue was reproducible using a minimal HAProxy configuration, independently of our production configuration.
Downgrading to package revision .2 resolved the problem immediately.
Reproduction results
The same IIS application, backend address, TLS certificate and minimal HAProxy configuration were tested with both package versions.
| Test | Revision .2 | Revision .3 |
|---|---|---|
| HTTP/1.1 through HAProxy | 200 OK | 502 Bad Gateway |
| HTTP/1.0 through HAProxy | 200 OK | 200 OK |
| Direct HTTP/1.1 to IIS | 200 OK | 200 OK |
When accessed directly over HTTP/1.1, the IIS application returns:
-
HTTP/1.1 200 OK
-
Transfer-Encoding: chunked
The direct curl request completes successfully with exit code 0.
When accessed using HTTP/1.0, the backend returns HTTP/1.1 200 OK with Connection: close and without Transfer-Encoding: chunked.
HAProxy diagnostics
The HAProxy runtime reports:
backend dynqr_cavvisit: invalid response
H1 msg state MSG_CHUNK_SIZE(26)
H1 chunk len 0 bytes
Other unrelated ASP.NET Core application backends exhibit similar errors.
Backend health checks remain UP / L4OK despite the HTTP failures.
Minimal reproduction configuration
global
maxconn 100
defaults
mode http
timeout connect 5s
timeout client 15s
timeout server 15s
frontend test
bind 127.0.0.1:18443 ssl crt /path/to/test-cert.pem
http-request set-header X-Forwarded-Proto https
default_backend test_backend
backend test_backend
option http-server-close
server app <IIS_BACKEND_IP>:8256 check
Identical configurations were launched as independent HAProxy instances using binaries extracted from the two Ubuntu packages.
Result with .3:
HTTP/1.1: 502
HTTP/1.0: 200
Result with .2:
HTTP/1.1: 200
HTTP/1.0: 200
No production configuration changes were required to reproduce the problem.
Timeline
-
2026-11-04 06:41:04 UTC: HAProxy upgraded automatically from .2 to .3.
-
Multiple ASP.NET Core services subsequently experienced HTTP 502 errors.
-
The issue was reproduced independently on a secondary HAProxy node.
-
Both production HAProxy nodes were rolled back to .2.
-
HTTP/1.1 requests returned 200 again after rollback.
Expected behavior
HAProxy should process valid HTTP/1.1 chunked responses from ASP.NET Core / IIS without returning HTTP 502.
Actual behavior
Package revision .3 rejects these responses with an HTTP parsing error in MSG_CHUNK_SIZE, while revision .2 processes the same backend responses successfully.
Operational impact
The regression caused a production outage affecting multiple application endpoints.
We have temporarily pinned HAProxy to revision .2 to restore service, but this is not an acceptable permanent solution because revision .3 contains security fixes.
Request
Could the Ubuntu Security Team investigate whether the CVE-2026-110354 HTTP/1.1 parser fix or its backport to HAProxy 2.4.30 introduced a response-parsing regression?
We would appreciate:
-
Confirmation of the root cause.
-
Any safe configuration workaround.
-
A corrected Ubuntu 22.04 security package.
We can provide sanitized runtime logs and additional reproducible test results if needed.