From b00f02d75ec984ca6f9c78b4bec88f3e2c3dc36f Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Thu, 16 Jul 2026 08:16:18 +0000 Subject: [PATCH] Fix CVE-2026-55204: NULL pointer dereference in hpack_dht_insert() Backport upstream fix for CVE-2026-55204 to haproxy 1.8.27. The patch adds a missing NULL check after the third call to hpack_dht_defrag() in hpack_dht_insert() (src/hpack-tbl.c), preventing a NULL pointer dereference (SIGSEGV) when pool_head_hpack_tbl is exhausted. CVE: CVE-2026-55204 Upstream patches: - https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513.patch Resolves: RHEL-211083 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- CVE-2026-55204-hpack-tbl-add-null-check.patch | 37 +++++++++++++++++++ haproxy.spec | 8 +++- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 CVE-2026-55204-hpack-tbl-add-null-check.patch diff --git a/CVE-2026-55204-hpack-tbl-add-null-check.patch b/CVE-2026-55204-hpack-tbl-add-null-check.patch new file mode 100644 index 0000000..d839537 --- /dev/null +++ b/CVE-2026-55204-hpack-tbl-add-null-check.patch @@ -0,0 +1,37 @@ +From 051642064150cdf6dab3b3cd57f59c3937c522bd Mon Sep 17 00:00:00 2001 +From: Tristan Madani +Date: Tue, 16 Jun 2026 10:42:10 +0200 +Subject: [PATCH] BUG/MINOR: hpack-tbl: add missing NULL check after + hpack_dht_defrag() + +hpack_dht_insert() has three call sites for hpack_dht_defrag(). Two of +them (lines 293 and 306) correctly check for a NULL return and bail out +with -1. The third (line 353, data-space defrag path) assigns the return +value to dht and immediately dereferences it without a NULL check. + +When pool_head_hpack_tbl is exhausted, hpack_dht_alloc() returns NULL, +hpack_dht_defrag() propagates it, and line 354 dereferences NULL+0x0a +(offsetof wrap), crashing the worker with SIGSEGV. + +Add a NULL check consistent with the two other call sites. + +This must be backported to all stable versions. + +Reported-by: Tristan (@TristanInSec) +--- + src/hpack-tbl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/hpack-tbl.c b/src/hpack-tbl.c +index 9ead9e8..1da1544 100644 +--- a/src/hpack-tbl.c ++++ b/src/hpack-tbl.c +@@ -359,6 +359,8 @@ int hpack_dht_insert(struct hpack_dht *dht, struct ist name, struct ist value) + else { + /* need to defragment the table before inserting upfront */ + dht = hpack_dht_defrag(dht); ++ if (!dht) ++ return -1; + wrap = dht->wrap + 1; + head = dht->head + 1; + dht->dte[head].addr = dht->dte[dht->front].addr - (name.len + value.len); diff --git a/haproxy.spec b/haproxy.spec index 4012c92..7a4a86f 100644 --- a/haproxy.spec +++ b/haproxy.spec @@ -8,7 +8,7 @@ Name: haproxy Version: 1.8.27 -Release: 5%{?dist}.1 +Release: 6%{?dist} Summary: HAProxy reverse proxy for high availability environments Group: System Environment/Daemons @@ -32,6 +32,7 @@ Patch6: CVE-2023-45539-add-istend-function.patch Patch7: CVE-2023-45539-add-http_path_forbidden_char-function.patch Patch8: CVE-2023-45539-pass-accept-invalid-http-request-parser.patch Patch9: CVE-2023-45539-reject-chars-from-path-pseudo-header.patch +Patch10: CVE-2026-55204-hpack-tbl-add-null-check.patch BuildRequires: lua-devel BuildRequires: pcre-devel @@ -71,6 +72,7 @@ availability environments. Indeed, it can: %patch7 -p1 %patch8 -p1 %patch9 -p1 +%patch10 -p1 %build regparm_opts= @@ -158,6 +160,10 @@ exit 0 %{_mandir}/man1/* %changelog +* Thu Jul 16 2026 RHEL Packaging Agent - 1.8.27-6 +- Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204, + RHEL-211083) + * Thu Sep 05 2024 Ryan O'Hara - 1.8.27-5.1 - Reject "#" as part of URI path component (CVE-2023-45539, RHEL-18168)