haproxy (3.2.9-1ubuntu3) stonking; urgency=medium

  * SECURITY UPDATE: overflow in FCGI demux record length field
    - debian/patches/CVE-2026-55203.patch: mux-fcgi: fix uint16_t overflow in
      drl += drp in src/mux_fcgi.c.
    - CVE-2026-55203
  * SECURITY UPDATE: NULL dereference in hpack_dht_insert()
    - debian/patches/CVE-2026-55204.patch: hpack-tbl: add missing NULL check
      after hpack_dht_defrag() in src/hpack-tbl.c.
    - CVE-2026-55204

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 19 Jun 2026 10:57:40 -0400

haproxy (3.2.9-1ubuntu2.1) resolute-security; urgency=medium

  * SECURITY UPDATE: HTTP/3 parser request smuggling issue
    - debian/patches/CVE-2026-33555.patch: check body size with
      content-length on empty FIN in src/h3.c.
    - CVE-2026-33555

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 15 Apr 2026 13:58:58 -0400

haproxy (3.2.9-1ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: crash in parsing frame type
    - debian/patches/CVE-2026-26080.patch: check for return value in
      src/quic_frame.c.
    - CVE-2026-26080
  * SECURITY UPDATE: crash via INITIAL packet for the NEW_TOKEN format
    - debian/patches/CVE-2026-26081.patch: reject invalid token
      in src/quic_token.c.
    - CVE-2026-26081
  * SECURITY UPDATE: crash in HTTP/3 CONNECT
    - debian/patches/quic-fix-1.patch: revert BUG_ON if sending on locally
      closed QCS in include/haproxy/qmux_http.h, src/mux_quic.c,
      src/qmux_http.c.
    - debian/patches/quic-fix-2.patch: reject frontend CONNECT as currently
      not implemented in src/h3.c.
    - CVE number pending

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 24 Feb 2026 12:34:52 -0500

haproxy (3.2.9-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2125994). Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe
  * Dropped changes:
    - SECURITY UPDATE: DoS via MJSON
      + d/p/CVE-2025-11230.patch: fix possible DoS when parsing numbers
        in src/mjson.c.
      + CVE-2025-11230
      [ Fixed in 3.2.6 ]

 -- Athos Ribeiro <athos@ubuntu.com>  Mon, 24 Nov 2025 17:49:17 -0300

haproxy (3.2.9-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 21 Nov 2025 22:10:08 +0100

haproxy (3.2.8-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sun, 09 Nov 2025 21:31:19 +0100

haproxy (3.2.7-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 25 Oct 2025 14:30:48 +0200

haproxy (3.2.6-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 03 Oct 2025 17:04:47 +0200

haproxy (3.2.5-2) unstable; urgency=high

  * CVE-2025-11230: fix possible DoS when parsing JSON numbers.

 -- Vincent Bernat <bernat@debian.org>  Thu, 02 Oct 2025 17:06:08 +0200

haproxy (3.2.5-1) unstable; urgency=medium

  * New upstream release.
  * Upload to unstable.
  * d/watch: update to version 5.

 -- Vincent Bernat <bernat@debian.org>  Fri, 26 Sep 2025 21:34:05 +0200

haproxy (3.2.4-1) experimental; urgency=medium

  * d/rules: build again without USE_QUIC_OPENSSL_COMPAT and require
    libssl (>= 3.5.1).

 -- Vincent Bernat <bernat@debian.org>  Thu, 14 Aug 2025 07:07:28 +0200

haproxy (3.2.3-2) experimental; urgency=medium

  * d/rules: build with USE_QUIC_OPENSSL_COMPAT until libssl (>= 3.5.1) is
    available in Trixie.

 -- Vincent Bernat <bernat@debian.org>  Fri, 11 Jul 2025 21:56:54 +0200

haproxy (3.2.3-1) experimental; urgency=medium

  [ Yaacov Akiba Slama ]
  * d/rules: do not build with USE_QUIC_OPENSSL_COMPAT.
  * d/control: Build-Depends on libssl (>= 3.5.0).

  [ Vincent Bernat ]
  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sun, 15 Jun 2025 10:33:43 +0200

haproxy (3.2.1-1) experimental; urgency=medium

  * New upstream release.
  * d/control: build-depends on libcrypt-dev. Closes: #1107033.

 -- Vincent Bernat <bernat@debian.org>  Sat, 14 Jun 2025 08:31:04 +0200

haproxy (3.2.0-1) experimental; urgency=medium

  * New upstream release.
  * d/copyright: update FSF address.

 -- Vincent Bernat <bernat@debian.org>  Thu, 29 May 2025 10:26:20 +0200

haproxy (3.1.7-1) experimental; urgency=medium

  * New upstream release. Fix CVE-2025-32464.

 -- Vincent Bernat <bernat@debian.org>  Sat, 19 Apr 2025 17:41:25 +0200

haproxy (3.1.6-1) experimental; urgency=medium

  * New upstream release.
  * d/control: drop Pre-Depends on dpkg. Closes: #1100452.

 -- Vincent Bernat <bernat@debian.org>  Sat, 22 Mar 2025 17:01:14 +0100

haproxy (3.1.5-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 21 Feb 2025 14:57:21 +0100

haproxy (3.1.3-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 29 Jan 2025 21:26:23 +0100

haproxy (3.1.2-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sun, 12 Jan 2025 15:55:49 +0100

haproxy (3.1.1-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 14 Dec 2024 21:21:15 +0100

haproxy (3.1.0-2) experimental; urgency=medium

  [ Helmut Grohne ]
  * Fix FTCBFS: (Closes: #1079532)
    + Require a sphinx for the build architecture.
    + Pass CC and PKG_CONFIG to all make targets.
    + cross.patch: Honour the passed ${PKG_CONFIG}.

 -- Vincent Bernat <bernat@debian.org>  Sun, 01 Dec 2024 18:08:58 +0100

haproxy (3.1.0-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 30 Nov 2024 23:34:36 +0100

haproxy (3.0.11-1) unstable; urgency=medium

  * New upstream release.
  * d/control: build-depends on libcrypt-dev. Closes: #1107033.

 -- Vincent Bernat <bernat@debian.org>  Tue, 03 Jun 2025 07:51:31 +0200

haproxy (3.0.10-1ubuntu3) questing; urgency=medium

  * SECURITY UPDATE: DoS via MJSON
    - debian/patches/CVE-2025-11230.patch: fix possible DoS when parsing
      numbers in src/mjson.c.
    - CVE-2025-11230

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 02 Oct 2025 07:59:53 -0400

haproxy (3.0.10-1ubuntu2) questing; urgency=medium

  * Rebuild to include updated RISC-V base ISA RVA23

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Fri, 05 Sep 2025 11:46:44 +0000

haproxy (3.0.10-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2110439). Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe
  * Dropped changes:
    - d/{control,rules}: do not link against jemalloc (universe)
      This can be dropped after (LP #2088056) got accepted.
      [ jemalloc is now in main ]
    - SECURITY UPDATE: heap overflow in sample_conv_regsub
      + debian/patches/CVE-2025-32464.patch: fix risk of overflow when
        replacing multiple regex back-refs in src/sample.c.
      + CVE-2025-32464
      [ Fixed in 3.0.10 ]

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 20 May 2025 12:27:08 -0300

haproxy (3.0.10-1) unstable; urgency=medium

  * New upstream release. Fix CVE-2025-32464.

 -- Vincent Bernat <bernat@debian.org>  Fri, 25 Apr 2025 15:24:21 +0200

haproxy (3.0.9-1) unstable; urgency=medium

  * New upstream release.
  * d/control: drop Pre-Depends on dpkg. Closes: #1100452

 -- Vincent Bernat <bernat@debian.org>  Sat, 22 Mar 2025 17:21:15 +0100

haproxy (3.0.8-1ubuntu1.1) plucky-security; urgency=medium

  * SECURITY UPDATE: heap overflow in sample_conv_regsub
    - debian/patches/CVE-2025-32464.patch: fix risk of overflow when
      replacing multiple regex back-refs in src/sample.c.
    - CVE-2025-32464

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 09 Apr 2025 08:46:16 -0400

haproxy (3.0.8-1ubuntu1) plucky; urgency=medium

  * Merge from Debian Unstable. Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe
    - d/{control,rules}: do not link against jemalloc (universe)
      This can be dropped after (LP #2088056) got accepted.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Tue, 11 Feb 2025 01:52:59 -0600

haproxy (3.0.8-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Wed, 29 Jan 2025 21:43:30 +0100

haproxy (3.0.7-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085234). Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe
    - d/{control,rules}: do not link against jemalloc (universe)
      This can be dropped after (LP #2088056) got accepted.

 -- Lukas Märdian <slyon@ubuntu.com>  Thu, 09 Jan 2025 10:00:59 +0100

haproxy (3.0.7-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 14 Dec 2024 21:40:24 +0100

haproxy (3.0.6-3) unstable; urgency=medium

  [ Helmut Grohne ]
  * Fix FTCBFS: (Closes: #1079532)
    + Require a sphinx for the build architecture.
    + Pass CC and PKG_CONFIG to all make targets.
    + cross.patch: Honour the passed ${PKG_CONFIG}.

 -- Vincent Bernat <bernat@debian.org>  Sun, 01 Dec 2024 18:35:09 +0100

haproxy (3.0.6-2) unstable; urgency=medium

  * Upload to unstable.
  * Update documentation converter.

 -- Vincent Bernat <bernat@debian.org>  Sat, 30 Nov 2024 18:28:45 +0100

haproxy (3.0.6-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Mon, 11 Nov 2024 17:37:04 +0100

haproxy (3.0.5-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 21 Sep 2024 11:07:55 +0200

haproxy (3.0.4-1) experimental; urgency=medium

  [ Apollon Oikonomopoulos ]
  * Build against Lua 5.4; thanks to Athos Ribeiro and Lena Voytek.
    Closes: #1074401.

  [ Vincent Bernat ]
  * New upstream release. Fix CVE-2024-45506.

 -- Vincent Bernat <bernat@debian.org>  Tue, 03 Sep 2024 16:58:45 +0200

haproxy (3.0.3-1) experimental; urgency=medium

  [ Apollon Oikonomopoulos ]
  * Build against Lua 5.4; thanks to Athos Ribeiro and Lena Voytek.
    Closes: #1074401.

  [ Vincent Bernat ]
  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 12 Jul 2024 22:02:01 +0200

haproxy (3.0.2-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 14 Jun 2024 22:23:20 +0200

haproxy (3.0.1-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Tue, 11 Jun 2024 04:08:37 +0200

haproxy (3.0.0-1) experimental; urgency=medium

  * New upstream release.
  * d/rules: use CFLAGS instead of DEBUG_CFLAGS.
  * d/rules: let upstream Makefile decides for libatomic.
  * d/patch: update patches.
  * d/control: build-depends on pkgconf instead of pkg-config.

 -- Vincent Bernat <bernat@debian.org>  Sat, 01 Jun 2024 12:25:32 +0200

haproxy (2.9.12-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Mon, 11 Nov 2024 17:30:30 +0100

haproxy (2.9.11-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 21 Sep 2024 14:50:05 +0200

haproxy (2.9.10-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2073315). Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe
    - d/{control,rules}: do not link against jemalloc (universe)
  * Dropped changes:
    - d/control: Upgrade lua build dependency to 5.4
      [ Fixed in 2.9.10-1 ]
    - d/rules: Change lua include location to /usr/include/lua5.4
      [ Fixed in 2.9.10-1 ]
    - d/p/CVE-2024-45506-1.patch: clear DEM_MROOM and MUX_MFULL at more
      places
      [ Fixed in 2.9.10 ]
    - d/p/CVE-2024-45506-2.patch: always clear MUX_MFULL and DEM_MROOM
      when clearing the mbuf
      [ Fixed in 2.9.10 ]

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 13 Sep 2024 10:35:04 -0300

haproxy (2.9.10-1) unstable; urgency=medium

  [ Apollon Oikonomopoulos ]
  * Build against Lua 5.4; thanks to Athos Ribeiro and Lena Voytek.
    Closes: #1074401.

  [ Vincent Bernat ]
  * New upstream release. Fix CVE-2024-45506.

 -- Vincent Bernat <bernat@debian.org>  Tue, 03 Sep 2024 16:43:27 +0200

haproxy (2.9.9-1ubuntu2) oracular; urgency=medium

  * SECURITY UPDATE: remote denial of service issue
    - debian/patches/CVE-2024-45506-1.patch: try to clear DEM_MROOM and
      MUX_MFULL at more places in src/mux_h2.c.
    - debian/patches/CVE-2024-45506-2.patch: always clear MUX_MFULL and
      DEM_MROOM when clearing the mbuf in src/mux_h2.c.
    - CVE-2024-45506

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 12 Sep 2024 12:04:03 -0400

haproxy (2.9.9-1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064406). Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe.
    - d/control: Upgrade lua build dependency to 5.4
    - d/rules: Change lua include location to /usr/include/lua5.4
    - d/{control,rules}: do not link against jemalloc (universe).

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 27 Jun 2024 21:44:27 -0300

haproxy (2.9.9-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 14 Jun 2024 21:50:59 +0200

haproxy (2.9.8-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Tue, 11 Jun 2024 23:10:44 +0200

haproxy (2.9.7-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 06 Apr 2024 11:40:25 +0200

haproxy (2.9.6-1) unstable; urgency=medium

  * New upstream release.
  * d/install: don't ship halog both in usr/bin and usr/sbin.
    Closes: #1064788.

 -- Vincent Bernat <bernat@debian.org>  Fri, 01 Mar 2024 22:01:08 +0100

haproxy (2.9.5-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 15 Feb 2024 22:21:25 +0100

haproxy (2.9.4-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Thu, 01 Feb 2024 22:39:57 +0100

haproxy (2.9.3-1) unstable; urgency=medium

  * New upstream release.
  * Upload to unstable. Let bite the bullet!

 -- Vincent Bernat <bernat@debian.org>  Thu, 18 Jan 2024 21:25:36 +0100

haproxy (2.9.2-1) experimental; urgency=medium

  * New upstream release.
  * Upload back to experimental.

 -- Vincent Bernat <bernat@debian.org>  Fri, 12 Jan 2024 20:55:52 +0100

haproxy (2.9.1-1) unstable; urgency=medium

  [ Chris Hofstaedtler ]
  * d/rules: use dh_installsystemd to install .service files.
    Closes: #1057943.

  [ Vincent Bernat ]
  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 15 Dec 2023 15:33:29 +0100

haproxy (2.9.0-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 09 Dec 2023 15:33:05 +0100

haproxy (2.8.5-2) UNRELEASED; urgency=medium

  * d/rules: use dh_installsystemd to install .service files.
    Closes: #1057943.

 -- Chris Hofstaedtler <zeha@debian.org>  Sun, 10 Dec 2023 20:15:00 +0100

haproxy (2.8.5-1ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 16:52:53 +1100

haproxy (2.8.5-1ubuntu2) noble; urgency=medium

  * No-change rebuild against libssl3t64

 -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Mar 2024 18:10:10 +0000

haproxy (2.8.5-1ubuntu1) noble; urgency=medium

  * Merge with Debian unstable (LP: #2040383). Remaining changes:
    - d/{control,rules}: Remove support for OpenTracing due to it being
      in universe.
    - d/control: Upgrade lua build dependency to 5.4
    - d/rules: Change lua include location to /usr/include/lua5.4
  * New changes:
    - d/{control,rules}: do not link against jemalloc (universe).

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 05 Jan 2024 11:05:29 -0300

haproxy (2.8.5-1) unstable; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Sat, 09 Dec 2023 16:14:43 +0100

haproxy (2.8.4-2) experimental; urgency=medium

  * d/rules: really link against jemalloc.
  * d/rules: enable USE_QUIC (with USE_QUIC_OPENSSL_COMPAT).

 -- Vincent Bernat <bernat@debian.org>  Wed, 22 Nov 2023 22:52:31 +0100

haproxy (2.8.4-1) experimental; urgency=medium

  * New upstream release.
  * d/rules: link against jemalloc.

 -- Vincent Bernat <bernat@debian.org>  Fri, 17 Nov 2023 19:53:48 +0100

haproxy (2.8.3-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Fri, 08 Sep 2023 20:25:39 +0200

haproxy (2.8.2-1) experimental; urgency=medium

  * New upstream release. Fix CVE-2023-40225.

 -- Vincent Bernat <bernat@debian.org>  Sat, 12 Aug 2023 13:33:36 +0200

haproxy (2.8.1-1) experimental; urgency=medium

  * New upstream release.

 -- Vincent Bernat <bernat@debian.org>  Mon, 03 Jul 2023 21:13:18 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog haproxy`.
