Ubuntu releases HAProxy update to fix regression in 22.04 LTS

Ubuntu has released USN-8972-2 to address a regression in the HAProxy load balancer specifically affecting the 22.04 LTS (Jammy Jellyfish) release. The regression was introduced in the previous security update, USN-8972-1, which was intended to patch two critical vulnerabilities.

This new update restores proper functionality for processing specific chunked requests that were broken by the prior patch. Users running HAProxy on Ubuntu 22.04 LTS should update to version 2.4.30-0ubuntu0.22.04.4 to ensure both security and stability.

Security vulnerabilities and regression details

• CVE-2026-110353: Addresses an issue where HAProxy incorrectly handled truncated HTTP/2 PING frames, which could allow a remote attacker to cause excessive CPU consumption and a denial of service.
• CVE-2026-110354: Addresses a vulnerability involving the incorrect handling of certain HTTP/1.1 chunked requests, also potentially leading to CPU exhaustion and denial of service.
• Regression Fix: The current update (version 2.4.30-0ubuntu0.22.04.4) specifically corrects a functional error in chunked request processing that was inadvertently introduced during the initial security remediation.
• Affected Platform: The issue is isolated to the HAProxy package within the Ubuntu 22.04 LTS distribution.

Why it matters

System administrators relying on Ubuntu 22.04 LTS for production load balancing must apply this update to avoid service disruptions caused by the chunked request regression. This release is critical for maintaining both the security posture and the operational stability of web infrastructure using HAProxy.