import UBI haproxy-2.8.14-3.el9_8.2

SOURCES/RHEL-211062-CVE-2026-55203-fix-uint16_t-overflow-in-mux-fcgi.patch

@@ -0,0 +1,37 @@
+From 46b5f87f2220cf2d54f03c2d8aad790d18e9c56f Mon Sep 17 00:00:00 2001
+From: Tristan Madani <tristan@talencesecurity.com>
+Date: Tue, 16 Jun 2026 10:46:03 +0200
+Subject: [PATCH] BUG/MEDIUM: mux-fcgi: fix uint16_t overflow in drl += drp
+
+The FCGI demux record length field (drl) is uint16_t. In the
+ignore_record path, the expression "fconn->drl += fconn->drp" overflows
+to 0 when contentLength=65535 and paddingLength>=1. This causes the
+state machine to consider the record complete without consuming any
+buffer data. The remaining buffer contents are then parsed as new FCGI
+record headers.
+
+The same drl+=drp pattern at lines 2382/2418/2475 is not affected
+because drl is guaranteed to be 0 at those points (all content bytes
+are consumed before reaching end_transfer).
+
+Widen drl from uint16_t to uint32_t so that the addition of drp
+(uint8_t, max 255) cannot overflow.
+
+Reported-by: Tristan (@TristanInSec)
+---
+ src/mux_fcgi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/mux_fcgi.c b/src/mux_fcgi.c
+index a5a192402..0053b8d0b 100644
+--- a/src/mux_fcgi.c
++++ b/src/mux_fcgi.c
+@@ -54,7 +54,7 @@ struct fcgi_conn {
+ 	uint32_t flags;                      /* Connection flags: FCGI_CF_* */
+ 
+ 	int16_t  dsi;                        /* dmux stream ID (<0 = idle ) */
+-	uint16_t drl;                        /* demux record length (if dsi >= 0) */
++	uint32_t drl;                        /* demux record length (if dsi >= 0) */
+ 	uint8_t  drt;                        /* demux record type (if dsi >= 0) */
+ 	uint8_t  drp;                        /* demux record padding (if dsi >= 0) */
+ 

SOURCES/RHEL-211082-CVE-2026-55204-add-missing-NULL-check-after-hpack_dht_defrag.patch

@@ -0,0 +1,37 @@
+From a28f18bfd56084b9077bbdac42709106eea5a2e0 Mon Sep 17 00:00:00 2001
+From: Tristan Madani <tristan@talencesecurity.com>
+Date: Tue, 16 Jun 2026 10:42:10 +0200
+Subject: [PATCH] BUG/MINOR: hpack-tbl: add missing NULL check after
+ hpack_dht_defrag()
+
+hpack_dht_insert() has three call sites for hpack_dht_defrag(). Two of
+them (lines 293 and 306) correctly check for a NULL return and bail out
+with -1. The third (line 353, data-space defrag path) assigns the return
+value to dht and immediately dereferences it without a NULL check.
+
+When pool_head_hpack_tbl is exhausted, hpack_dht_alloc() returns NULL,
+hpack_dht_defrag() propagates it, and line 354 dereferences NULL+0x0a
+(offsetof wrap), crashing the worker with SIGSEGV.
+
+Add a NULL check consistent with the two other call sites.
+
+This must be backported to all stable versions.
+
+Reported-by: Tristan (@TristanInSec)
+---
+ src/hpack-tbl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/hpack-tbl.c b/src/hpack-tbl.c
+index 990d2f7dd..92a6f4435 100644
+--- a/src/hpack-tbl.c
++++ b/src/hpack-tbl.c
+@@ -351,6 +351,8 @@ int hpack_dht_insert(struct hpack_dht *dht, struct ist name, struct ist value)
+ 	else {
+ 		/* need to defragment the table before inserting upfront */
+ 		dht = hpack_dht_defrag(dht);
++		if (!dht)
++			return -1;
+ 		wrap = dht->wrap + 1;
+ 		head = dht->head + 1;
+ 		dht->dte[head].addr = dht->dte[dht->front].addr - (name.len + value.len);

SPECS/haproxy.spec

@@ -8,7 +8,7 @@
 
 Name:           haproxy
 Version:        2.8.14
-Release:        3%{?dist}
+Release:        3%{?dist}.2
 Summary:        HAProxy reverse proxy for high availability environments
 
 License:        GPLv2+
@@ -22,6 +22,10 @@ Source4:        %{name}.sysconfig
 Source5:        %{name}.sysusers
 Source6:        halog.1
 Patch0:         RHEL-126665-CVE-2025-11230-fix-denial-of-service-vulnerability-in-mjson-library.patch
+# https://github.com/haproxy/haproxy/commit/5985276735777634d8c85f1d73bb7764aab0d6dd
+Patch1:         RHEL-211062-CVE-2026-55203-fix-uint16_t-overflow-in-mux-fcgi.patch
+# https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513.patch
+Patch2:         RHEL-211082-CVE-2026-55204-add-missing-NULL-check-after-hpack_dht_defrag.patch
 
 BuildRequires:  gcc
 BuildRequires:  lua-devel
@@ -133,6 +137,14 @@ echo "d /var/lib/haproxy 0755 root root - -" > %{buildroot}%{_tmpfilesdir}/%{nam
 %{_tmpfilesdir}/%{name}.conf
 
 %changelog
+* Thu Jul 16 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.8.14-3.2
+- Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204)
+  Resolves: RHEL-211082
+
+* Thu Jul 16 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.8.14-3.1
+- Fix uint16_t overflow in FCGI demux record length (CVE-2026-55203)
+  Resolves: RHEL-211062
+
 * Thu Nov  6 2025 Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.8.14-3
 - Fix denial of service vulnerability in mjson library (CVE-2025-11230)
   Resolves: RHEL-126665