# Regression in Ubuntu 22.04 HAProxy security update: HTTP/1.1 chunked responses cause 502 Bad Gateway

**URL:** <https://discourse.haproxy.org/t/regression-in-ubuntu-22-04-haproxy-security-update-http-1-1-chunked-responses-cause-502-bad-gateway/12804>\
**Category:** Help!\
**Created:** [November 4, 2026, 9:00am UTC](https://discourse.haproxy.org/t/regression-in-ubuntu-22-04-haproxy-security-update-http-1-1-chunked-responses-cause-502-bad-gateway/12804 "2026-11-04T09:00:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![carl-hugo.bellmark](https://avatars.discourse-cdn.com/v4/letter/c/dfb087/32.png) [@carl-hugo.bellmark](https://discourse.haproxy.org/u/carl-hugo.bellmark)\
**Post date:** [November 4, 2026, 9:00am UTC](https://discourse.haproxy.org/t/regression-in-ubuntu-22-04-haproxy-security-update-http-1-1-chunked-responses-cause-502-bad-gateway/12804/1 "2026-11-04T09:00:09Z")

</div>

# Regression in Ubuntu 22.04 HAProxy security update: HTTP/1.1 chunked responses cause 502 Bad Gateway

**Package:** haproxy  
**Ubuntu release:** 22.04 LTS (Jammy)  
**Working package:** 2.4.30-0ubuntu0.22.04.2  
**Affected package:** 2.4.30-0ubuntu0.22.04.3  
**Related security notice:** USN-8972-1  
**Suggested tag:** regression-update

## Summary

After upgrading HAProxy from package revision .2 to .3 on 4 November 2026, multiple production [ASP.NET](http://ASP.NET) Core applications (.NET 8, 9 and 10) began returning HTTP 502 Bad Gateway through HAProxy.

Older [ASP.NET](http://ASP.NET) Framework applications remained functional.

The issue was reproducible using a minimal HAProxy configuration, independently of our production configuration.

Downgrading to package revision .2 resolved the problem immediately.

## Reproduction results

The same IIS application, backend address, TLS certificate and minimal HAProxy configuration were tested with both package versions.

| Test | Revision .2 | Revision .3 |
| --- | --- | --- |
| HTTP/1.1 through HAProxy | 200 OK | 502 Bad Gateway |
| HTTP/1.0 through HAProxy | 200 OK | 200 OK |
| Direct HTTP/1.1 to IIS | 200 OK | 200 OK |

When accessed directly over HTTP/1.1, the IIS application returns:

- HTTP/1.1 200 OK

- Transfer-Encoding: chunked

The direct curl request completes successfully with exit code 0.

When accessed using HTTP/1.0, the backend returns HTTP/1.1 200 OK with Connection: close and without Transfer-Encoding: chunked.

## HAProxy diagnostics

The HAProxy runtime reports:

```auto
backend dynqr_cavvisit: invalid response
H1 msg state MSG_CHUNK_SIZE(26)
H1 chunk len 0 bytes

```

Other unrelated [ASP.NET](http://ASP.NET) Core application backends exhibit similar errors.

Backend health checks remain UP / L4OK despite the HTTP failures.

## Minimal reproduction configuration

```auto
global
    maxconn 100

defaults
    mode http
    timeout connect 5s
    timeout client 15s
    timeout server 15s

frontend test
    bind 127.0.0.1:18443 ssl crt /path/to/test-cert.pem
    http-request set-header X-Forwarded-Proto https
    default_backend test_backend

backend test_backend
    option http-server-close
    server app <IIS_BACKEND_IP>:8256 check

```

Identical configurations were launched as independent HAProxy instances using binaries extracted from the two Ubuntu packages.

**Result with .3:**

```auto
HTTP/1.1: 502
HTTP/1.0: 200

```

**Result with .2:**

```auto
HTTP/1.1: 200
HTTP/1.0: 200

```

No production configuration changes were required to reproduce the problem.

## Timeline

- 2026-11-04 06:41:04 UTC: HAProxy upgraded automatically from .2 to .3.

- Multiple [ASP.NET](http://ASP.NET) Core services subsequently experienced HTTP 502 errors.

- The issue was reproduced independently on a secondary HAProxy node.

- Both production HAProxy nodes were rolled back to .2.

- HTTP/1.1 requests returned 200 again after rollback.

## Expected behavior

HAProxy should process valid HTTP/1.1 chunked responses from [ASP.NET](http://ASP.NET) Core / IIS without returning HTTP 502.

## Actual behavior

Package revision .3 rejects these responses with an HTTP parsing error in MSG\_CHUNK\_SIZE, while revision .2 processes the same backend responses successfully.

## Operational impact

The regression caused a production outage affecting multiple application endpoints.

We have temporarily pinned HAProxy to revision .2 to restore service, but this is not an acceptable permanent solution because revision .3 contains security fixes.

## Request

Could the Ubuntu Security Team investigate whether the CVE-2026-110354 HTTP/1.1 parser fix or its backport to HAProxy 2.4.30 introduced a response-parsing regression?

We would appreciate:

1. Confirmation of the root cause.

2. Any safe configuration workaround.

3. A corrected Ubuntu 22.04 security package.

We can provide sanitized runtime logs and additional reproducible test results if needed.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [November 4, 2026, 9:15am UTC](https://discourse.haproxy.org/t/regression-in-ubuntu-22-04-haproxy-security-update-http-1-1-chunked-responses-cause-502-bad-gateway/12804/2 "2026-11-04T09:15:58Z")

</div>

From Haproxy perspective 2.4 is unmaintained.

This is something that Ubuntu has to figure out; and it looks like this is already in progress:

> **[Bug #2172897 “haproxy 2.4.30-0ubuntu0.22.04.3: CVE-2026-110354 b...” : Bugs :...](https://bugs.launchpad.net/ubuntu/+source/haproxy/+bug/2172897)**
>
> Release: Ubuntu 22.04 LTS (jammy)
> Package: haproxy 2.4.30-0ubuntu0.22.04.3 (jammy-security, USN-8972-1)
> Previous version: 2.4.30-0ubuntu0.22.04.2 (works)
> 
> \[Impact\]
> After upgrading from .2 to .3, a large share (roughly 50-70%) of requests
> through...