From 2d1cf48b6d6c6390bea39bda691136211a54e2dc Mon Sep 17 00:00:00 2001 From: Oyvind Albrigtsen Date: Mon, 10 Aug 2026 13:15:24 +0200 Subject: [PATCH] - Fix uint16_t overflow in FCGI demux record length (CVE-2026-55203) Resolves: RHEL-211067 - Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204) Resolves: RHEL-211085 --- ...03-fix-uint16_t-overflow-in-mux-fcgi.patch | 37 +++++++++++++++++++ ...ng-NULL-check-after-hpack_dht_defrag.patch | 37 +++++++++++++++++++ haproxy.spec | 15 +++++++- 3 files changed, 87 insertions(+), 2 deletions(-) create mode 100644 RHEL-211067-CVE-2026-55203-fix-uint16_t-overflow-in-mux-fcgi.patch create mode 100644 RHEL-211085-CVE-2026-55204-add-missing-NULL-check-after-hpack_dht_defrag.patch diff --git a/RHEL-211067-CVE-2026-55203-fix-uint16_t-overflow-in-mux-fcgi.patch b/RHEL-211067-CVE-2026-55203-fix-uint16_t-overflow-in-mux-fcgi.patch new file mode 100644 index 0000000..c644118 --- /dev/null +++ b/RHEL-211067-CVE-2026-55203-fix-uint16_t-overflow-in-mux-fcgi.patch @@ -0,0 +1,37 @@ +From 5985276735777634d8c85f1d73bb7764aab0d6dd Mon Sep 17 00:00:00 2001 +From: Tristan Madani +Date: Tue, 16 Jun 2026 10:46:03 +0200 +Subject: [PATCH] BUG/MEDIUM: mux-fcgi: fix uint16_t overflow in drl += drp + +The FCGI demux record length field (drl) is uint16_t. In the +ignore_record path, the expression "fconn->drl += fconn->drp" overflows +to 0 when contentLength=65535 and paddingLength>=1. This causes the +state machine to consider the record complete without consuming any +buffer data. The remaining buffer contents are then parsed as new FCGI +record headers. + +The same drl+=drp pattern at lines 2382/2418/2475 is not affected +because drl is guaranteed to be 0 at those points (all content bytes +are consumed before reaching end_transfer). + +Widen drl from uint16_t to uint32_t so that the addition of drp +(uint8_t, max 255) cannot overflow. + +Reported-by: Tristan (@TristanInSec) +--- + src/mux_fcgi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c +index c956b58add56..8d81ff8499de 100644 +--- a/src/mux_fcgi.c ++++ b/src/mux_fcgi.c +@@ -54,7 +54,7 @@ struct fcgi_conn { + uint32_t flags; /* Connection flags: FCGI_CF_* */ + + int16_t dsi; /* dmux stream ID (<0 = idle ) */ +- uint16_t drl; /* demux record length (if dsi >= 0) */ ++ uint32_t drl; /* demux record length (if dsi >= 0) */ + uint8_t drt; /* demux record type (if dsi >= 0) */ + uint8_t drp; /* demux record padding (if dsi >= 0) */ + diff --git a/RHEL-211085-CVE-2026-55204-add-missing-NULL-check-after-hpack_dht_defrag.patch b/RHEL-211085-CVE-2026-55204-add-missing-NULL-check-after-hpack_dht_defrag.patch new file mode 100644 index 0000000..0ee1064 --- /dev/null +++ b/RHEL-211085-CVE-2026-55204-add-missing-NULL-check-after-hpack_dht_defrag.patch @@ -0,0 +1,37 @@ +From 9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513 Mon Sep 17 00:00:00 2001 +From: Tristan Madani +Date: Tue, 16 Jun 2026 10:42:10 +0200 +Subject: [PATCH] BUG/MINOR: hpack-tbl: add missing NULL check after + hpack_dht_defrag() + +hpack_dht_insert() has three call sites for hpack_dht_defrag(). Two of +them (lines 293 and 306) correctly check for a NULL return and bail out +with -1. The third (line 353, data-space defrag path) assigns the return +value to dht and immediately dereferences it without a NULL check. + +When pool_head_hpack_tbl is exhausted, hpack_dht_alloc() returns NULL, +hpack_dht_defrag() propagates it, and line 354 dereferences NULL+0x0a +(offsetof wrap), crashing the worker with SIGSEGV. + +Add a NULL check consistent with the two other call sites. + +This must be backported to all stable versions. + +Reported-by: Tristan (@TristanInSec) +--- + src/hpack-tbl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/hpack-tbl.c b/src/hpack-tbl.c +index 990d2f7ddf93..92a6f4435510 100644 +--- a/src/hpack-tbl.c ++++ b/src/hpack-tbl.c +@@ -351,6 +351,8 @@ int hpack_dht_insert(struct hpack_dht *dht, struct ist name, struct ist value) + else { + /* need to defragment the table before inserting upfront */ + dht = hpack_dht_defrag(dht); ++ if (!dht) ++ return -1; + wrap = dht->wrap + 1; + head = dht->head + 1; + dht->dte[head].addr = dht->dte[dht->front].addr - (name.len + value.len); diff --git a/haproxy.spec b/haproxy.spec index 1efe07c..3b8cda0 100644 --- a/haproxy.spec +++ b/haproxy.spec @@ -8,7 +8,7 @@ Name: haproxy Version: 3.0.5 -Release: 7%{?dist} +Release: 8%{?dist} Summary: HAProxy reverse proxy for high availability environments License: GPL-2.0-or-later @@ -23,6 +23,8 @@ Source5: %{name}.sysusers Source6: halog.1 Patch0: RHEL-126653-CVE-2025-11230-fix-denial-of-service-vulnerability-in-mjson-library.patch Patch1: RHEL-170588-peers-fix-OOB-heap-write-in-dictionary-cache-update.patch +Patch2: RHEL-211067-CVE-2026-55203-fix-uint16_t-overflow-in-mux-fcgi.patch +Patch3: RHEL-211085-CVE-2026-55204-add-missing-NULL-check-after-hpack_dht_defrag.patch BuildRequires: gcc BuildRequires: lua-devel @@ -52,7 +54,10 @@ availability environments. Indeed, it can: %prep %setup -q -%autopatch -p1 +%patch -p1 -P 0 +%patch -p1 -P 1 +%patch -p1 -P 2 +%patch -p1 -P 3 %build make %{?_smp_mflags} CPU="generic" TARGET="linux-glibc" USE_OPENSSL=1 USE_PCRE2=1 USE_SLZ=1 USE_LUA=1 USE_CRYPT_H=1 USE_SYSTEMD=1 USE_LINUX_TPROXY=1 USE_GETADDRINFO=1 USE_PROMEX=1 DEFINE=-DMAX_SESS_STKCTR=12 ADDINC="%{build_cflags}" ADDLIB="%{build_ldflags}" @@ -134,6 +139,12 @@ echo "d /var/lib/haproxy 0755 root root - -" > %{buildroot}%{_tmpfilesdir}/%{nam %{_tmpfilesdir}/%{name}.conf %changelog +* Mon Aug 10 2026 Oyvind Albrigtsen - 3.0.5-8 +- Fix uint16_t overflow in FCGI demux record length (CVE-2026-55203) + Resolves: RHEL-211067 +- Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204) + Resolves: RHEL-211085 + * Tue May 5 2026 Oyvind Albrigtsen - 3.0.5-7 - peers: fix OOB heap write in dictionary cache update Resolves: RHEL-170588