From 52c19c9afe229dd044afb4916055aa90ea4210ee Mon Sep 17 00:00:00 2001 From: PengLAI Code Date: Sat, 29 Aug 2026 14:14:47 +0800 Subject: [PATCH] [CVE] [Upstream] add patch to fix CVE-2026-26081 to #IK565J Upstream: https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=4765277f4f915baac2d57db63538ff0a59966deb project: TC2024080204 Assisted-by: PengLAI Code --- CVE-2026-26081.patch | 43 +++++++++++++++++++++++++++++++++++++++++++ haproxy.spec | 7 ++++++- 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 CVE-2026-26081.patch diff --git a/CVE-2026-26081.patch b/CVE-2026-26081.patch new file mode 100644 index 0000000..4825e8b --- /dev/null +++ b/CVE-2026-26081.patch @@ -0,0 +1,43 @@ +From 4765277f4f915baac2d57db63538ff0a59966deb Mon Sep 17 00:00:00 2001 +From: Amaury Denoyelle +Date: Mon, 9 Feb 2026 08:04:13 +0000 +Subject: [PATCH] BUG/MAJOR: quic: reject invalid token + +Token parsing code on INITIAL packet for the NEW_TOKEN format is not +robust enough and may even crash on some rare malformed packets. + +This patch fixes this by adding a check on the expected length of the +received token. The packet is now rejected if the token does not match +QUIC_TOKEN_LEN. This check is legitimate as haproxy should only parse +tokens emitted by itself. + +This issue has been introduced with the implementation of NEW_TOKEN +tokens parsing required for 0-RTT support. + +This issue is assigned to CVE-2026-26081 report. + +This must be backported up to 3.0. + +Reported-by: Asim Viladi Oglu Manizada +Signed-off-by: Amaury Denoyelle +Adapted-by: PengLAI Code +--- + src/quic_token.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/quic_token.c b/src/quic_token.c +index 4f33447..9c1d69c 100644 +--- a/src/quic_token.c ++++ b/src/quic_token.c +@@ -129,6 +129,11 @@ int quic_token_check(struct quic_rx_packet *pkt, + goto err; + } + ++ if (tokenlen != QUIC_TOKEN_LEN) { ++ TRACE_ERROR("invalid token length", QUIC_EV_CONN_LPKT, qc); ++ goto err; ++ } ++ + /* Generate the AAD. */ + aadlen = ipaddrcpy(aad, &dgram->saddr); + rand = token + tokenlen - QUIC_TOKEN_RAND_DLEN; diff --git a/haproxy.spec b/haproxy.spec index ff86198..8b8cb6f 100644 --- a/haproxy.spec +++ b/haproxy.spec @@ -1,4 +1,4 @@ -%define anolis_release 1 +%define anolis_release 2 %define haproxy_user haproxy %define haproxy_group %{haproxy_user} %define haproxy_homedir %{_localstatedir}/lib/haproxy @@ -25,6 +25,8 @@ Source6: halog.1 # https://github.com/haproxy/haproxy/commit/06675db4bf234ed17e14305f1d59259d2fe78b06.patch Patch1: 1-bugfix-for-CVE-2025-11230.patch +# https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=4765277f4f915baac2d57db63538ff0a59966deb +Patch2: CVE-2026-26081.patch BuildRequires: gcc BuildRequires: lua-devel @@ -148,6 +150,9 @@ done %doc CHANGELOG VERSION %changelog +* Sat Aug 29 2026 PengLAI Code - 3.2.0-2 +- add patch to fix CVE-2026-26081 + * Wed Jan 07 2026 lzq11122 - 3.2.0-1 - Update to 3.2.0 for fix CVE-2025-59303 - Remove patch new version include -- Gitee