From 7024937c9404cdb46a0d07fbb818b54bc52e65be Mon Sep 17 00:00:00 2001 From: PengLAI Code Date: Sat, 29 Aug 2026 13:20:08 +0800 Subject: [PATCH] [CVE] [Upstream] add patch to fix CVE-2026-55204 to #IK224D commit 9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513 upstream. project: TC2024080204 Assisted-by: PengLAI Code --- CVE-2026-55204.patch | 37 +++++++++++++++++++++++++++++++++++++ haproxy.spec | 10 +++++++++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 CVE-2026-55204.patch diff --git a/CVE-2026-55204.patch b/CVE-2026-55204.patch new file mode 100644 index 0000000..0ee1064 --- /dev/null +++ b/CVE-2026-55204.patch @@ -0,0 +1,37 @@ +From 9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513 Mon Sep 17 00:00:00 2001 +From: Tristan Madani +Date: Tue, 16 Jun 2026 10:42:10 +0200 +Subject: [PATCH] BUG/MINOR: hpack-tbl: add missing NULL check after + hpack_dht_defrag() + +hpack_dht_insert() has three call sites for hpack_dht_defrag(). Two of +them (lines 293 and 306) correctly check for a NULL return and bail out +with -1. The third (line 353, data-space defrag path) assigns the return +value to dht and immediately dereferences it without a NULL check. + +When pool_head_hpack_tbl is exhausted, hpack_dht_alloc() returns NULL, +hpack_dht_defrag() propagates it, and line 354 dereferences NULL+0x0a +(offsetof wrap), crashing the worker with SIGSEGV. + +Add a NULL check consistent with the two other call sites. + +This must be backported to all stable versions. + +Reported-by: Tristan (@TristanInSec) +--- + src/hpack-tbl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/src/hpack-tbl.c b/src/hpack-tbl.c +index 990d2f7ddf93..92a6f4435510 100644 +--- a/src/hpack-tbl.c ++++ b/src/hpack-tbl.c +@@ -351,6 +351,8 @@ int hpack_dht_insert(struct hpack_dht *dht, struct ist name, struct ist value) + else { + /* need to defragment the table before inserting upfront */ + dht = hpack_dht_defrag(dht); ++ if (!dht) ++ return -1; + wrap = dht->wrap + 1; + head = dht->head + 1; + dht->dte[head].addr = dht->dte[dht->front].addr - (name.len + value.len); diff --git a/haproxy.spec b/haproxy.spec index c29a669..2236ae7 100644 --- a/haproxy.spec +++ b/haproxy.spec @@ -1,4 +1,4 @@ -%define anolis_release 2 +%define anolis_release 3 %define haproxy_user haproxy %define haproxy_group %{haproxy_user} %define haproxy_homedir %{_localstatedir}/lib/haproxy @@ -25,6 +25,10 @@ Source6: halog.1 # https://github.com/haproxy/haproxy/commit/06675db4bf234ed17e14305f1d59259d2fe78b06.patch Patch1: 1-bugfix-for-CVE-2025-11230.patch +# CVE-2026-55204 +# Source: upstream +# Reference: https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513 +Patch2: CVE-2026-55204.patch BuildRequires: gcc BuildRequires: lua-devel @@ -148,6 +152,10 @@ done %doc CHANGELOG VERSION %changelog +* Sat Aug 29 2026 PengLAI Code - 3.2.0-3 +- Fix CVE-2026-55204 +- Upstream patch: https://github.com/haproxy/haproxy/commit/9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513 + * Wed Jun 17 2026 mgb01105731 - 3.2.0-2 - Rebuild with gcc 14 -- Gitee