<div class="container">
<h1>Security update for haproxy</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:24418-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-10-23T17:10:20Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1285046">bsc#1285046</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Micro 6.2</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that has one fix can now be installed.</p>
<h2>Description:</h2>
<p>This update for haproxy fixes the following issue:</p>
<ul>
<li>h1-htx: report an error on a too long chunk-size line (bsc#1285046).</li>
</ul>
<p>Changes for haproxy:</p>
<ul>
<li>Otel Update to version 2.3.0+git2.b031728:</li>
<li>DOC: otel: added a security policy to the repository</li>
<li>MINOR: otel: test: added a test with an optional upstream context</li>
<li>VERSION: otel: bumped filter version to 2.3.0</li>
<li>DOC: otel: shortened the repeated passages of the implementation guide</li>
<li>BUG/MINOR: otel: left a baggage pair out when its sample yielded nothing</li>
<li>DOC: otel: completed the stream stop notes and the function reference</li>
<li>DOC: otel: added the load-time warnings and missing rules to the guides</li>
<li>DOC: otel: corrected stale statements across the guides and notes</li>
<li>DOC: otel: corrected and completed the keyword guides</li>
<li>CLEANUP: otel: marked the code that cannot run with a NOTE comment</li>
<li>CLEANUP: otel: described the invalid-character check modes</li>
<li>MINOR: otel: checked the context field key against the W3C rules</li>
<li>DOC: otel: added an overview of the tests</li>
<li>MINOR: otel: reported the event pairings on the line that completes them</li>
<li>MINOR: otel: warned about an otel-scope that never runs</li>
<li>MINOR: otel: enforced the root span rules</li>
<li>MINOR: otel: validated the span and context names of every reference</li>
<li>MINOR: otel: enforced the rules of the inject and extract context names</li>
<li>MINOR: otel: bound the instrument lines of one name to a single owner</li>
<li>MINOR: otel: let a key repeat once per condition, first match applied</li>
<li>MINOR: otel: gave the 'link' keyword a condition and let it repeat</li>
<li>MINOR: otel: allowed the 'otel-stop' keyword to be repeated</li>
<li>MINOR: otel: ended a sample list at a repeated clause of the same line</li>
<li>MINOR: otel: separated a repeated span line from a redefinition</li>
<li>MINOR: otel: checked the metric instrument line against the SDK rules</li>
<li>MINOR: otel: allowed each otel-instrumentation keyword only once</li>
<li>MINOR: otel: required the configuration to live inside an OTel scope</li>
<li>MINOR: otel: allowed the configuration sections in any order</li>
<li>MINOR: otel: rejected a bare 'if' or 'unless' with no ACL term</li>
<li>MINOR: otel: made an ACL name unique within its section</li>
<li>BUG/MINOR: otel: allowed a condition to mix ACLs from the three lists</li>
<li>MINOR: otel: refused the reserved words as names and limited the length</li>
<li>MINOR: otel: named the sample key where the value stands on its own</li>
<li>BUG/MINOR: otel: read the whole filter line before its configuration</li>
<li>BUG/MINOR: otel: allowed a repeated sample expression in one value</li>
<li>BUG/MINOR: otel: stopped measuring a sample expression as a name</li>
<li>BUG/MINOR: otel: named the 'config' keyword in its own parse error</li>
<li>CLEANUP: otel: compared the baggage carrier key without case folding</li>
<li>CLEANUP: otel: replaced the word 'verbatim' in the comments and guides</li>
<li>CLEANUP: otel: added the entry traces to the functions that lacked them</li>
<li>CLEANUP: otel: collected the repeated error messages into macros</li>
<li>MINOR: otel: test: added the configuration parser test</li>
<li>DOC: otel: added the keyword definition rules and updated the guides</li>
<li>CLEANUP: otel: replaced the word 'gate' in the comments and guides</li>
<li>MINOR: otel: warned about the events the filter placement never fires</li>
<li>BUG/MINOR: otel: kept a backend filter from re-running the frontend rules</li>
<li>BUG/MINOR: otel: fired on-server-unavailable when no server was reached</li>
<li>BUG/MINOR: otel: armed the idle timer for a filter of a backend section</li>
<li>MINOR: otel: required every otel-group to be named on a 'groups' line</li>
<li>BUG/MINOR: otel: cleared the section state after an aborted parse</li>
<li>BUG/MINOR: otel: gave the events that run on no channel a usable direction</li>
<li>CLEANUP: otel: used the span event dump macro where the events are handled</li>
<li>MINOR: otel: checked 'extract use-headers' against the scope event</li>
<li>BUG/MINOR: otel: kept the session alive when a root scope is skipped</li>
<li>CLEANUP: otel: collected the session disabling into one function</li>
<li>LICENSE: otel: added the LICENSE file and moved the headers to the GPL</li>
<li>MINOR: otel: added a sampler level to the speed test</li>
<li>MINOR: otel: evaluated the samples in a trash buffer</li>
<li>MEDIUM: otel: skipped the samples of a span that records nothing</li>
<li>Update to version 3.4.7+git0.8872a2604:</li>
<li>[RELEASE] Released version 3.4.7</li>
<li>BUG/MAJOR: h1-htx: report an error on a too long chunk-size line (bsc#1285046)</li>
<li>BUG/MAJOR: mux-h2: properly handle short reads on PING frames</li>
<li>BUG/MINOR: cfgparse-global: only warn when "localpeer" is set together with -L</li>
<li>REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests</li>
<li>REGTESTS: http-messaging: Fix http_fail_cnt_body to succeed with small timeouts</li>
<li>BUG/MEDIUM: mux-h1: only accept the H2 preface on the first request</li>
<li>BUG/MINOR: http-fetch: don't report pseudo-headers in TCP mode</li>
<li>BUG/MEDIUM: mux-h1: also release the embryonic stream when the error is empty</li>
<li>BUG/MEDIUM: mux-h2: fix a possible crash on rxbuf allocation failure</li>
<li>BUG/MEDIUM: mux-h2: report a dead rhttp connection in h2_wake()</li>
<li>BUG/MEDIUM: mux-h1: don't pass an upgraded connection to traces in h1s_destroy()</li>
<li>BUG/MEDIUM: mux-fcgi: don't return a freed tasklet from fcgi_deferred_shut()</li>
<li>BUG/MEDIUM: mux-h2: don't return a freed tasklet from h2_deferred_shut()</li>
<li>BUG/MINOR: hlua: assume proxy_find_by_id() may return NULL on previously existing server</li>
<li>BUG/MINOR: spoe: Fix the message list splice with an empty list</li>
<li>REGTESTS: log: check that a log-forward TCP session ends on client close</li>
<li>BUG/MEDIUM: log: do not ignore the peer's shutdown in the syslog applet</li>
<li>REGTESTS: cli: test a command line of exactly tune.bufsize bytes</li>
<li>BUG/MEDIUM: cli: fix the last command detection on a full command line</li>
<li>BUG/MINOR: cfgparse-listen: complete the list of options for the suggestions</li>
<li>BUG/MINOR: proxy: also look for the closest option among cfg_opts3</li>
<li>BUG/MINOR: cfgparse-listen: properly reject extra args in a backend section</li>
<li>BUG/MINOR: cfgparse-listen: fix quoting of the condition conflict warning</li>
<li>BUG/MINOR: cfgparse-listen: fix the argument checked by "email-alert"</li>
<li>BUG/MINOR: cfgparse-listen: release the previous description of the proxy</li>
<li>BUG/MINOR: cfgparse-global: add missing calloc() check for the global description</li>
<li>BUG/MINOR: cfgparse-global: add missing gotos to error label in max-spread-checks</li>
<li>BUG/MAJOR: cfgparse: properly check userlist section when scanning keywords</li>
<li>MINOR: doc: elaborate on diagnostic mode behavior</li>
<li>BUG/MINOR: ssl: Fix potential NULL-deref in "dump ssl cert" with AWS-LC</li>
<li>BUG/MINOR: h3: reject RS/SS for QPACK uni streams</li>
<li>BUG/MINOR: h3: close connection on GOAWAY frame too long</li>
<li>BUG/MINOR: h3: reject frames with truncated header</li>
<li>BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream</li>
<li>BUG/MINOR: ssl: use standard names for X25519 and X448 groups</li>
<li>BUG/MEDIUM: listener: Consider maxconn before waking listeners</li>
<li>BUG/MEDIUM: ssl: crt-list curves ignored with AWS-LC</li>
<li>BUG/MEDIUM: ssl: crt-list ciphers ignored with AWS-LC</li>
<li>BUG/MINOR: ssl: fix trace crash on BE conn release in io cb</li>
<li>BUG/MINOR: ssl: fix trace crash on FE conn release in io cb</li>
<li>BUG/MINOR: hq-interop: prevent double EOM on request with standalone FIN</li>
<li>BUG/MINOR: log: fix erroneous error message in log-steps parser</li>
<li>MINOR: http-ana: automatically enable http-no-delay for streaming events (SSE)</li>
<li>BUG/MINOR: cli: update wait help usage</li>
<li>BUG/MINOR: server: fix "del server" description</li>
<li>BUG/MINOR: proxy: add PR_CAP_LB for dynamically added backend</li>
<li>DOC: config: mention that url_ip and url_port fail when passed a name</li>
<li>DOC: config: fix doc for hex2i() converter on unparsable input</li>
<li>DOC: config: mention other responses not blocked by option checkcache</li>
<li>BUG/MINOR: sample: return the decoded JWT part when no path is given</li>
<li>BUG/MEDIUM: tcpcheck: do not run a regex on an unallocated buffer</li>
<li>BUG/MINOR: http-fetch: do not count Set-Cookie attributes as cookies</li>
<li>BUG/MINOR: payload: always report a boolean from req.ssl_ec_ext</li>
<li>BUG/MINOR: stick-table: do not count the lookup itself in table_trackers()</li>
<li>BUG/MINOR: http-ana: return a 502 when checkcache blocks a response</li>
<li>BUG/MINOR: sample: make quic_enabled() always succeed</li>
<li>BUG/MINOR: sample: zero-pad the fractional part emitted by http_date()</li>
<li>BUG/MINOR: sample: apply the ms_/us_ time offsets in the input unit</li>
<li>BUG/MINOR: http: do not consume the delimiter of a truncated q-factor</li>
<li>BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5)</li>
<li>BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5</li>
<li>BUG/MEDIUM: pattern: don't dereference static_pattern's data when not filling it</li>
<li>BUG/MEDIUM: stick-table: restrict key sizes to what fits in a buffer</li>
<li>MINOR: stick-table: calculate the on-wire size of each key</li>
<li>MINOR: stick-table: provide a function to estimate on-wire data size</li>
<li>BUILD: haring: fix compile issue due to nop warning.</li>
<li>MINOR: stconn: prefer to replace endpoints rather than detaching them</li>
<li>BUG/MINOR: flt-http-comp: Rely on htx_set_eom() to restore EOM flag</li>
<li>BUG/MEDIUM: flt-http-comp: Block HTX_FL_EOM flag till the end of compression</li>
<li>MINOR: quic: implement the AEAD integrity limit</li>
<li>MEDIUM: jwt: Reject "none" alg in jwt_verify by default</li>
<li>[RELEASE] Released version 3.4.6</li>
<li>REGTESTS: log: check that a ring's internal server may target a UNIX socket</li>
<li>BUG/MEDIUM: server: skip log backend addr checks for internal proxies</li>
<li>BUG/MEDIUM: sink: reconnect attempt not working after session lasted more than ~25 days</li>
<li>BUG/MAJOR: mux_quic: fix potential crash on RESET_STREAM receive</li>
<li>MINOR: log: add the +utf8 encoding option to let valid UTF-8 pass</li>
<li>MINOR: log: pass the input end to the _lf_encode_bytes() byte encoders</li>
<li>[RELEASE] Released version 3.4.5</li>
<li>BUG/MINOR: mux-h2: Reject trailers received on a tunneled stream</li>
<li>REGTESTS: log: check the escaping performed by the +json option</li>
<li>BUG/MEDIUM: log: encode the whole non-printable range in the +json output</li>
<li>BUG/MEDIUM: mux_quic: activate timeout on FE init</li>
<li>BUG/MAJOR: mux_quic: fix leak on RESET_STREAM reception</li>
<li>BUG/MINOR: http-ana: restore the transaction status after early hints</li>
<li>BUG/MINOR: tcpcheck: refresh the start-line after updating the authority</li>
<li>BUG/MINOR: mux-h1: only mark C-L and T-E as sent once the header is emitted</li>
<li>BUG/MINOR: http-fetch: fix the space check of http_auth_bearer(<hdr>)</li>
<li>BUG/MINOR: http-fetch: http_auth_bearer() must not match a missing header</li>
<li>BUG/MINOR: http-ana: count response body failures only once in http_fail_cnt</li>
<li>BUG/MEDIUM: tcp-rules: ignore "capture len" rules evaluated from a backend</li>
<li>BUG/MEDIUM: http-act: ignore "capture len" rules evaluated from a backend</li>
<li>BUG/MEDIUM: http-htx: don't build the new authority in a rotating trash chunk</li>
<li>BUG/MEDIUM: log: reserve the trailing 0 in CBOR int and bool encoders</li>
<li>REG-TESTS: http-messaging: Add a script to test interim responses for H1/H2</li>
<li>BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses</li>
<li>BUG/MINOR: http-client: Convert server timeout ticks when setting it</li>
<li>BUG/MINOR: ssl: Fix possible null deref on the SSL context in ssl_sock_to_buf()</li>
<li>BUG/MINOR: hlua: release private Lua rule data on teardown</li>
<li>BUG/MAJOR: htx: Check the header/trailer length limits when one is updated</li>
<li>BUG/MINOR: tools: Don't try to anonymize a NULL string</li>
<li>BUG/MEDIUM: htx: Fix the position returned by htx_defrag()</li>
<li>BUG/MEDIUM: http-client/cli: Notify the http-client when the response is consumed</li>
<li>MINOR: http-client: Add a function to notify some data were consumed</li>
<li>BUG/MEDIUM: acme: Set HTTPCLIENT_O_RES_ACCUM option on the http-client</li>
<li>BUG/MEDIUM: ssl/ocsp: Set HTTPCLIENT_O_RES_ACCUM option on the http-client</li>
<li>MINOR: http-client: Add an option to not stop the reception of the response</li>
<li>BUG/MEDIUM: http-client: Don't use the httpclient context if it was released</li>
<li>BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy</li>
<li>OPTIM: tools: keep a cache of recent localtime() and gmtime()</li>
<li>MAJOR: filters: Revert the filter-sequence directive</li>
<li>BUG/MINOR: proxy: pass PR_FL_DEF_EXPLICIT_MODE through cascaded defaults</li>
<li>BUG/MEDIUM: tcp-rules: Don't restart tcp-request content evaluation on yield</li>
<li>CLEANUP: stream: Remove an excess newline in the stream dump</li>
<li>BUG/MEDIUM: htx: Reserve a block descriptor for zero-sized blocks</li>
<li>BUG/MEDIUM: ssl: don't set a 0 timeout on an expired TLS session</li>
<li>DOC: configuration: clarify the validity ranges of sample types</li>
<li>REGTESTS: http-rules: check "-m str" on a sample with an embedded \0</li>
<li>BUG/MINOR: sample: reject a \0 byte in url_dec, json_query and jwt_*_query</li>
<li>BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry</li>
<li>BUG/MINOR: cli: Reject payload with no command</li>
<li>BUG/MEDIUM: cli: Don't read a command or payload line into a full buffer</li>
<li>BUG/MEDIUM: cli: Don't parse next command if input buffer is empty</li>
<li>BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a condition</li>
<li>REGTESTS: map: check map_regm inside an ACL over an iterating fetch</li>
<li>BUG/MEDIUM: map: do not overwrite the fetch context in pat_match_regm()</li>
<li>BUG/MINOR: ssl: don't pass the address of a size_t as an int* to OpenSSL</li>
<li>BUG/MEDIUM: http-ana: apply tunnel timeout with data filters</li>
<li>BUG/MINOR: h3: only increment frame type counter on new header</li>
<li>BUG/MINOR: h3: handle unknown frame type on request stream as specified</li>
<li>BUG/MINOR: h3: handle empty HEADERS frame as specified</li>
<li>BUG/MEDIUM: h3: do not block FIN on empty DATA frame</li>
<li>BUG/MINOR: h3: reject truncated frames with mandatory payload</li>
<li>BUG/MINOR: stream/debug: harden the stream dump function regarding signals</li>
<li>BUG/MEDIUM: htx: Don't reset flags when source must be preserved during transfer</li>
<li>BUG/MINOR: hlua: Always return nil if there is no data to dup for HTTP messages</li>
<li>BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished</li>
<li>BUG/MEDIUM: hlua: Never release a cosocket applet from the GC</li>
<li>DOC: config: clarify tune tune.bufsize doc regarding various limits</li>
<li>BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure</li>
<li>BUG/MAJOR: h3: reject H3 truncated frames</li>
<li>BUG/MEDIUM: mux-h2: Make sure we remove H2_SF_NOTIFIED on subscribe</li>
<li>MEDIUM: mux-h1: Harden test for short data at end of stream</li>
<li>REGTESTS: log: check that the +cbor output passes the logged bytes through</li>
<li>DOC: config: mention that section 8.6 does not apply to the cbor encoding</li>
<li>REGTESTS: log: check which log-format tags escape control characters</li>
<li>REGTESTS: log: add a test for "show events -s"</li>
<li>MINOR: ring: add "-s" flag to "show events" to sanitize the output</li>
<li>BUG/MINOR: quic: delete the wrong CIDs when post-handshake frames fail</li>
<li>BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached</li>
<li>BUG/MINOR: qpack: encoder and decoder stream data is never consumed</li>
<li>MINOR: quic: protect the ChaCha20 header protection context from being freed</li>
<li>CLEANUP: resolvers: stop clearing the DNS response buffer</li>
<li>BUG/MINOR: resolvers: classify empty truncated responses</li>
<li>BUN/MINOR: hlua: reset hlua_body variable after per-thread files loading</li>
<li>BUG/MEDIUM: filters: check the filter name before comparing it</li>
<li>BUG/MINOR: quic: late packets of the first key phase are dropped</li>
<li>BUG/MEDIUM: quic: crash on key update phase change after a failed one</li>
<li>BUG/MINOR: payload: bound ClientHello extension lists by the extension length</li>
<li>BUG/MINOR: payload: fix the cipher_len bound check in smp_client_hello_parse()</li>
<li>BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames</li>
<li>OPTIM: server: remember the lowest known unused server ID</li>
<li>BUG/MINOR: cache: Seed cache primary hash</li>
<li>BUG/MINOR: cache: Manage collisions on primary key</li>
<li>Update to version 3.4.3+git88.24ec4c12d:</li>
<li>BUG/MEDIUM: sink: do not create one implicit ring per logger copy</li>
<li>BUG/MEDIUM: sink: initialize the settings of the implicit log server</li>
<li>BUG/MINOR: flt-http-comp: Don't read next block to detect end of data</li>
<li>BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters</li>
<li>BUG/MEDIUM: cache: ignore cache on redundant origin/referer</li>
<li>REGTESTS: converters: use connection: close in the has_ctl() test</li>
<li>MINOR: debug: check the match count in __BUG_ON_ONCE() and not in complain()</li>
<li>MINOR: sample: add new converter has_ctl() to detect control characters</li>
<li>DOC: haterm: add a missing 'haterm' build target on an example</li>
<li>BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages()</li>
<li>BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch</li>
<li>MEDIUM: mux-h2: don't report EOM on a short content-length message</li>
<li>BUG/MEDIUM: mux-h1: close the connection on a short content-length</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Micro 6.2
<br/>
<code>zypper in -t patch SUSE-SL-Micro-6.2-1969</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64)
<ul>
<li>haproxy-3.4.7+git0.8872a2604-160000.1.1</li>
<li>haproxy-debuginfo-3.4.7+git0.8872a2604-160000.1.1</li>
<li>haproxy-debugsource-3.4.7+git0.8872a2604-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1285046">https://bugzilla.suse.com/show_bug.cgi?id=1285046</a>
</li>
</ul>
</div>