rpms/haproxy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-55204: NULL pointer dereference in hpack_dht_insert()

Browse Source 
Backport upstream fix for CVE-2026-55204 to haproxy 1.8.27.
The patch adds a missing NULL check after the third call to
hpack_dht_defrag() in hpack_dht_insert() (src/hpack-tbl.c),
preventing a NULL pointer dereference (SIGSEGV) when
pool_head_hpack_tbl is exhausted.

CVE: CVE-2026-55204
Upstream patches:
 - 9a6d1fe3f0.patch
Resolves: RHEL-211083

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-16 08:16:18 +00:00
parent d05c4c5d7f
commit b00f02d75e
2 changed files with 44 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
CVE-2026-55204-hpack-tbl-add-null-check.patch Normal file
View File

@ -0,0 +1,37 @@
From 051642064150cdf6dab3b3cd57f59c3937c522bd Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Tue, 16 Jun 2026 10:42:10 +0200
Subject: [PATCH] BUG/MINOR: hpack-tbl: add missing NULL check after
hpack_dht_defrag()
hpack_dht_insert() has three call sites for hpack_dht_defrag(). Two of
them (lines 293 and 306) correctly check for a NULL return and bail out
with -1. The third (line 353, data-space defrag path) assigns the return
value to dht and immediately dereferences it without a NULL check.
When pool_head_hpack_tbl is exhausted, hpack_dht_alloc() returns NULL,
hpack_dht_defrag() propagates it, and line 354 dereferences NULL+0x0a
(offsetof wrap), crashing the worker with SIGSEGV.
Add a NULL check consistent with the two other call sites.
This must be backported to all stable versions.
Reported-by: Tristan (@TristanInSec)
---
src/hpack-tbl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/src/hpack-tbl.c b/src/hpack-tbl.c
index 9ead9e8..1da1544 100644
--- a/src/hpack-tbl.c
+++ b/src/hpack-tbl.c
@@ -359,6 +359,8 @@ int hpack_dht_insert(struct hpack_dht *dht, struct ist name, struct ist value)
else {
/* need to defragment the table before inserting upfront */
dht = hpack_dht_defrag(dht);
+ if (!dht)
+ return -1;
wrap = dht->wrap + 1;
head = dht->head + 1;
dht->dte[head].addr = dht->dte[dht->front].addr - (name.len + value.len);

8
haproxy.spec
View File

@ -8,7 +8,7 @@
Name: haproxy
Version: 1.8.27
Release: 5%{?dist}.1
Release: 6%{?dist}
Summary: HAProxy reverse proxy for high availability environments
Group: System Environment/Daemons
@ -32,6 +32,7 @@ Patch6: CVE-2023-45539-add-istend-function.patch
Patch7: CVE-2023-45539-add-http_path_forbidden_char-function.patch
Patch8: CVE-2023-45539-pass-accept-invalid-http-request-parser.patch
Patch9: CVE-2023-45539-reject-chars-from-path-pseudo-header.patch
Patch10: CVE-2026-55204-hpack-tbl-add-null-check.patch
BuildRequires: lua-devel
BuildRequires: pcre-devel
@ -71,6 +72,7 @@ availability environments. Indeed, it can:
%patch7 -p1
%patch8 -p1
%patch9 -p1
%patch10 -p1
%build
regparm_opts=
@ -158,6 +160,10 @@ exit 0
%{_mandir}/man1/*
%changelog
* Thu Jul 16 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.8.27-6
- Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204,
RHEL-211083)
* Thu Sep 05 2024 Ryan O'Hara <rohara@redhat.com> - 1.8.27-5.1
- Reject "#" as part of URI path component (CVE-2023-45539, RHEL-18168)