Search filters

Type

Section

Actions

Changelog - HAProxy Enterprise 3.4r1

#2026/10/09 : 3.4r1 (1.0.0-381.448)

  • BUG/MAJORh1-htxreport an error on a too long chunk-size line
  • BUG/MAJORmux-h2properly handle short reads on PING frames
  • REGTESTShttp-messagingFix http_fail_cnt_body to succeed with small timeouts
  • BUG/MEDIUMmux-h1only accept the H2 preface on the first request
  • BUG/MINORhttp-fetchdon't report pseudo-headers in TCP mode
  • BUG/MEDIUMmux-h1also release the embryonic stream when the error is empty
  • BUG/MEDIUMmux-h2fix a possible crash on rxbuf allocation failure
  • BUG/MEDIUMmux-h2report a dead rhttp connection in h2_wake()
  • BUG/MEDIUMmux-h1don't pass an upgraded connection to traces in h1s_destroy()
  • BUG/MEDIUMmux-fcgidon't return a freed tasklet from fcgi_deferred_shut()
  • BUG/MEDIUMmux-h2don't return a freed tasklet from h2_deferred_shut()
  • BUG/MINORhluaassume proxy_find_by_id() may return NULL on previously existing server
  • BUG/MINORspoeFix the message list splice with an empty list
  • REGTESTSlogcheck that a log-forward TCP session ends on client close
  • BUG/MEDIUMlogdo not ignore the peer's shutdown in the syslog applet
  • REGTESTSclitest a command line of exactly tune.bufsize bytes
  • BUG/MEDIUMclifix the last command detection on a full command line
  • BUG/MINORcfgparse-listencomplete the list of options for the suggestions
  • BUG/MINORproxyalso look for the closest option among cfg_opts3
  • BUG/MINORcfgparse-listenproperly reject extra args in a backend section
  • BUG/MINORcfgparse-listenfix quoting of the condition conflict warning
  • BUG/MINORcfgparse-listenfix the argument checked by email-alert
  • BUG/MINORcfgparse-listenrelease the previous description of the proxy
  • BUG/MINORcfgparse-globaladd missing calloc() check for the global description
  • BUG/MINORcfgparse-globaladd missing gotos to error label in max-spread-checks
  • BUG/MAJORcfgparseproperly check userlist section when scanning keywords
  • MINORdocelaborate on diagnostic mode behavior
  • BUG/MINORsslFix potential NULL-deref in dump ssl cert with AWS-LC
  • BUG/MINORh3reject RS/SS for QPACK uni streams
  • BUG/MINORh3close connection on GOAWAY frame too long
  • BUG/MINORh3reject frames with truncated header
  • BUG/MINORmux_quicextend FINAL_SIZE_ERROR detection on stream
  • BUG/MINORssluse standard names for X25519 and X448 groups
  • BUG/MEDIUMlistenerConsider maxconn before waking listeners
  • BUG/MEDIUMsslcrt-list curves ignored with AWS-LC
  • BUG/MEDIUMsslcrt-list ciphers ignored with AWS-LC
  • BUG/MINORsslfix trace crash on BE conn release in io cb
  • BUG/MINORsslfix trace crash on FE conn release in io cb
  • BUG/MINORhq-interopprevent double EOM on request with standalone FIN
  • BUG/MINORlogfix erroneous error message in log-steps parser
  • MINORhttp-anaautomatically enable http-no-delay for streaming events (SSE)
  • BUG/MINORcliupdate wait help usage
  • BUG/MINORserverfix del server description
  • BUG/MINORproxyadd PR_CAP_LB for dynamically added backend
  • DOCconfigmention that url_ip and url_port fail when passed a name
  • DOCconfigfix doc for hex2i() converter on unparsable input
  • DOCconfigmention other responses not blocked by option checkcache
  • BUG/MINORsamplereturn the decoded JWT part when no path is given
  • BUG/MEDIUMtcpcheckdo not run a regex on an unallocated buffer
  • BUG/MINORhttp-fetchdo not count Set-Cookie attributes as cookies
  • BUG/MINORpayloadalways report a boolean from req.ssl_ec_ext
  • BUG/MINORstick-tabledo not count the lookup itself in table_trackers()
  • BUG/MINORhttp-anareturn a 502 when checkcache blocks a response
  • BUG/MINORsamplemake quic_enabled() always succeed
  • BUG/MINORsamplezero-pad the fractional part emitted by http_date()
  • BUG/MINORsampleapply the ms_/us_ time offsets in the input unit
  • BUG/MINORhttpdo not consume the delimiter of a truncated q-factor
  • BUG/MINORjweAvoid buffer overflow in fake cek (RSA1.5)
  • BUG/MINORjweBuffer overflow when filling fake cek in case of RSA1.5
  • BUG/MEDIUMpatterndon't dereference static_pattern's data when not filling it
  • BUG/MEDIUMstick-tablerestrict key sizes to what fits in a buffer
  • MINORstick-tablecalculate the on-wire size of each key
  • MINORstick-tableprovide a function to estimate on-wire data size
  • BUILDharingfix compile issue due to nop warning.
  • MINORstconnprefer to replace endpoints rather than detaching them
  • BUG/MINORflt-http-compRely on htx_set_eom() to restore EOM flag
  • BUG/MEDIUMflt-http-compBlock HTX_FL_EOM flag till the end of compression
  • MINORquicimplement the AEAD integrity limit
  • MEDIUMjwtReject none alg in jwt_verify by default
  • MINORstatsreport the SSL library FIPS mode in show info
  • MINORsslreport FIPS mode in -vv for OpenSSL >= 3.0 too
  • MEDIUMssladd fips_mode() config condition predicate
  • MINORhapeeupdate to new URLs
  • BUILDsslavoid mixed declarations in the AWS-LC curve fetch
  • MINORsslsupport curve fetches with AWS-LC API 30
  • REGTESTSlogcheck that a ring's internal server may target a UNIX socket
  • BUG/MEDIUMserverskip log backend addr checks for internal proxies
  • BUG/MEDIUMsinkreconnect attempt not working after session lasted more than ~25 days
  • BUG/MAJORmux_quicfix potential crash on RESET_STREAM receive
  • MINORlogadd the +utf8 encoding option to let valid UTF-8 pass
  • MINORlogpass the input end to the _lf_encode_bytes() byte encoders
  • BUG/MINORmux-h2Reject trailers received on a tunneled stream
  • REGTESTSlogcheck the escaping performed by the +json option
  • BUG/MEDIUMlogencode the whole non-printable range in the +json output

#2026/09/24 : 3.4r1 (1.0.0-381.364)

  • BUG/MEDIUMmux_quicactivate timeout on FE init
  • BUG/MAJORmux_quicfix leak on RESET_STREAM reception
  • BUG/MINORhttp-anarestore the transaction status after early hints
  • BUG/MINORtcpcheckrefresh the start-line after updating the authority
  • BUG/MINORmux-h1only mark C-L and T-E as sent once the header is emitted
  • BUG/MINORhttp-fetchfix the space check of http_auth_bearer(<hdr>)
  • BUG/MINORhttp-fetchhttp_auth_bearer() must not match a missing header
  • BUG/MINORhttp-anacount response body failures only once in http_fail_cnt
  • BUG/MEDIUMtcp-rulesignore capture len rules evaluated from a backend
  • BUG/MEDIUMhttp-actignore capture len rules evaluated from a backend
  • BUG/MEDIUMhttp-htxdon't build the new authority in a rotating trash chunk
  • BUG/MEDIUMlogreserve the trailing 0 in CBOR int and bool encoders
  • REG-TESTShttp-messagingAdd a script to test interim responses for H1/H2
  • BUG/MINORmux-h2Don't expect more HTX data on 1xx interim responses
  • BUG/MINORhttp-clientConvert server timeout ticks when setting it
  • BUG/MINORsslFix possible null deref on the SSL context in ssl_sock_to_buf()
  • BUG/MINORhluarelease private Lua rule data on teardown
  • BUG/MAJORhtxCheck the header/trailer length limits when one is updated
  • BUG/MINORtoolsDon't try to anonymize a NULL string
  • BUG/MEDIUMhtxFix the position returned by htx_defrag()
  • BUG/MEDIUMhttp-client/cliNotify the http-client when the response is consumed
  • MINORhttp-clientAdd a function to notify some data were consumed
  • BUG/MEDIUMacmeSet HTTPCLIENT_O_RES_ACCUM option on the http-client
  • BUG/MEDIUMssl/ocspSet HTTPCLIENT_O_RES_ACCUM option on the http-client
  • MINORhttp-clientAdd an option to not stop the reception of the response
  • BUG/MEDIUMhttp-clientDon't use the httpclient context if it was released
  • BUG/MEDIUMtaskDo not destroy a task that is not ours in task_destroy

#2026/09/19 : 3.4r1 (1.0.0-381.337)

  • OPTIMtoolskeep a cache of recent localtime() and gmtime()
  • MAJORfiltersRevert the filter-sequence directive
  • BUG/MINORproxypass PR_FL_DEF_EXPLICIT_MODE through cascaded defaults
  • BUG/MEDIUMtcp-rulesDon't restart tcp-request content evaluation on yield
  • CLEANUPstreamRemove an excess newline in the stream dump
  • BUG/MEDIUMhtxReserve a block descriptor for zero-sized blocks
  • BUG/MEDIUMssldon't set a 0 timeout on an expired TLS session
  • DOCconfigurationclarify the validity ranges of sample types
  • REGTESTShttp-rulescheck -m str on a sample with an embedded \0
  • BUG/MINORsamplereject a \0 byte in url_dec, json_query and jwt_*_query
  • BUG/MINORsslFix leak of ca_list in cafile_entry
  • BUG/MINORcliReject payload with no command
  • BUG/MEDIUMcliDon't read a command or payload line into a full buffer
  • BUG/MEDIUMcliDon't parse next command if input buffer is empty
  • BUG/MEDIUMhttp_actfix normalize-uri normalizer selection with a condition
  • REGTESTSmapcheck map_regm inside an ACL over an iterating fetch
  • BUG/MEDIUMmapdo not overwrite the fetch context in pat_match_regm()
  • BUG/MINORssldon't pass the address of a size_t as an int* to OpenSSL
  • BUG/MEDIUMhttp-anaapply tunnel timeout with data filters
  • BUG/MINORh3only increment frame type counter on new header
  • BUG/MINORh3handle unknown frame type on request stream as specified
  • BUG/MINORh3handle empty HEADERS frame as specified
  • BUG/MEDIUMh3do not block FIN on empty DATA frame
  • BUG/MINORh3reject truncated frames with mandatory payload
  • BUG/MINORstream/debugharden the stream dump function regarding signals
  • BUG/MEDIUMhtxDon't reset flags when source must be preserved during transfer
  • BUG/MINORhluaAlways return nil if there is no data to dup for HTTP messages
  • BUG/MINORmux-h1Return an error on trailers if last chunk is unfinished
  • BUG/MEDIUMhluaNever release a cosocket applet from the GC
  • DOCconfigclarify tune tune.bufsize doc regarding various limits
  • BUG/MINORquicleak of the NEW_TOKEN frame on token generation failure
  • BUG/MAJORh3reject H3 truncated frames
  • BUG/MEDIUMmux-h2Make sure we remove H2_SF_NOTIFIED on subscribe
  • MEDIUMmux-h1Harden test for short data at end of stream
  • REGTESTSlogcheck that the +cbor output passes the logged bytes through
  • DOCconfigmention that section 8.6 does not apply to the cbor encoding
  • REGTESTSlogcheck which log-format tags escape control characters
  • REGTESTSlogadd a test for show events -s
  • MINORringadd -s flag to show events to sanitize the output
  • BUG/MINORquicdelete the wrong CIDs when post-handshake frames fail
  • BUG/MINORqpackaccept a Required Insert Count which cannot be reached
  • BUG/MINORqpackencoder and decoder stream data is never consumed
  • MINORquicprotect the ChaCha20 header protection context from being freed
  • CLEANUPresolversstop clearing the DNS response buffer
  • BUG/MINORresolversclassify empty truncated responses
  • BUN/MINORhluareset hlua_body variable after per-thread files loading
  • BUG/MEDIUMfilterscheck the filter name before comparing it
  • BUG/MINORquiclate packets of the first key phase are dropped
  • BUG/MEDIUMquiccrash on key update phase change after a failed one
  • BUG/MINORpayloadbound ClientHello extension lists by the extension length
  • BUG/MINORpayloadfix the cipher_len bound check in smp_client_hello_parse()
  • BUG/MEDIUMmux-spopProperly handle parsing of split HELLO/DISCONNECT frames
  • OPTIMserverremember the lowest known unused server ID
  • BUG/MINORcacheSeed cache primary hash
  • BUG/MINORcacheManage collisions on primary key

#2026/09/16 : 3.4r1 (1.0.0-380.282)

  • BUG/MEDIUMsinkdo not create one implicit ring per logger copy
  • BUG/MEDIUMsinkinitialize the settings of the implicit log server
  • BUG/MINORflt-http-compDon't read next block to detect end of data
  • BUG/MINORfcgi-appallow explicit filter declaration with non-cache/non-compression filters
  • BUG/MEDIUMcacheignore cache on redundant origin/referer
  • REGTESTSconvertersuse connection: close in the has_ctl() test
  • MINORdebugcheck the match count in __BUG_ON_ONCE() and not in complain()
  • MINORsampleadd new converter has_ctl() to detect control characters
  • DOChatermadd a missing 'haterm' build target on an example
  • BUG/MEDIUMsinkdo not hold the sft lock around ring_dispatch_messages()
  • BUG/MEDIUMconnectionfix an infinite loop in the fc_pp_tlv() fetch
  • MEDIUMmux-h2don't report EOM on a short content-length message
  • BUG/MEDIUMmux-h1close the connection on a short content-length
  • BUILDsslavoid a potential null-dereference warning on OpenSSL 1.0.2
  • BUG/MINORhbuftreat unexpected escape sequences as literals
  • BUG/MINORechfix label at end of compound statement
  • BUG/MEDIUMmux-fcgicheck the room left before appending the index
  • BUG/MEDIUMsinkpre-initialize the implicit log forwarding server
  • BUG/MINORresolversaccept fields at the response boundary
  • BUG/MINORssl/clifix frontend-not-found detection in 'show ssl sni -f'
  • BUG/MINORhaproxyfix out-of-scope tmpdir usage in do_chroot()
  • BUG/MEDIUMsslisolate TLS session resumption per authentication policy
  • BUG/MINORsslisolate TLS session resumption per crt-list filter
  • BUG/MEDIUMsslisolate TLS session resumption per X509 server certificate
  • BUILDssldisable the TLS1.3 session timeout clamp on wolfSSL
  • BUG/MINORsslapply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC
  • BUG/MEDIUMsslenforce tune.ssl.lifetime across TLS1.3 session renewals
  • BUG/MEDIUMsslFix unprotected 'ssl_sock_choose_sni_ctx' calls
  • BUG/MINORsslrelease the previous client cert reference at depth > 0
  • BUG/MINORsslFix leak of X509_NAME in traces
  • BUG/MINORconnDo not check 'sess_el' list on frontend connections in __trace_enabled
  • BUG/MINORmux-h2harden h2_dump_h2s_info() against potentially null h2s->sd
  • BUG/MINORlogfix double-free error when error in parse_loger occurs
  • BUG/MINORqpackmissing shift count check in qpack_get_varint() (UB)
  • BUG/MINORspoecheck snprintf() return value in spoe_set_var/spoe_unset_var
  • BUG/MINORpayloadfix handshake length off-by-4 in ssl_hello_sni/alpn
  • BUG/MEDIUMbwlimfix a stick-table entry leak in shared mode
  • DOCsecurityclarify that only up-to-date versions may get securty reports
  • BUG/MEDIUMhttpfix authority parsing for absolute-form URI with empty path
  • BUG/MINORserverfix off-by-one error when parsing and copying source port range
  • BUG/MINORquicavoid a division by zero in the BBR pacing interval
  • BUG/MINORsslreject an embedded NUL in the full-DN ssl_*_dn() fetches
  • BUG/MINORsslreject an embedded NUL in the ssl_*_dn(entry) fetches
  • BUG/MEDIUMcachedo not release an entry under the cache read lock
  • BUG/MEDIUMcacheretain the primary or secondary entry only when detaching its row
  • DOCconfigclarify req.ssl_sni
  • BUG/MEDIUMhlua_fcnensure systematic bref cleanup for patref list iterator
  • BUG/MEDIUMluaresume Channel:send() from the unsent part of the string
  • BUG/MINORquicdrop multiple Retry on same connection
  • BUG/MEDIUMquicprevent out-of-bound read on wrapping CRYPTO content
  • BUG/MINORmux-h2strip the userinfo when deriving :authority for a server
  • BUG/MINORdebugonly dump the trace once in __BUG_ON_ONCE()
  • BUG/MINORlb-chashbound the walk when the saved cursor changed tree
  • BUG/MEDIUMsessiondon't release a reversed connection twice on error
  • BUG/MINORconnectionreserve the whole CRC32C TLV before saving its pointer
  • BUG/MINORacmerestrict the permissions of the generated account key
  • BUG/MINORsslreject server certificate names containing a NUL byte
  • BUG/MEDIUMacmedon't delete a NULL token from the map
  • BUG/MEDIUMsslrequire a full-length AEAD tag when decrypting with AES-GCM
  • BUG/MINORjwtdon't take an extra reference on the certificate public key
  • BUG/MEDIUMjwevalidate the secret length against the algorithm of the token
  • BUG/MEDIUMlogalways reserve room for trailing 0 when using CBOR encoding helpers
  • MINORlog/toolsfix ambiguous comments for some log encoding helpers
  • BUG/MINORmux-fcgisanitize the STDERR records before logging them
  • BUG/MEDIUMhttp-anacheck the cookie rewrite result before moving the offsets
  • BUG/MEDIUMsockbound the recvmsg() length when receiving old sockets
  • BUG/MEDIUMstick-tablesuse the same bucket for string keys with a NUL
  • BUG/MEDIUMhttp-anadon't crash on keep-query in a response redirect
  • BUG/MINORmux-fcgidon't call fcgi_strm_destroy() on a NULL stream
  • BUG/MEDIUMspoeclear the applet pointer when the applet fails to start
  • DEVharingbound the ring geometry to the size of the file
  • BUG/MINORhluause a local buffer to format the socket addresses
  • BUG/MINORstats-filereject tgid 0 when preloading shm objects
  • BUG/MEDIUMhpackencode long methods and schemes using the long form
  • REGTESTSproxycomplete del backend test
  • BUG/MINORproxyrelease watcher in various commands on CLI abort
  • DOCexplain better that named defaults are preserved
  • MINORproxyimplement unpublished backend keyword
  • BUG/MINORproxyfix default-server leak on post-parsing cleanup
  • BUG/MINORservercheck strdup return value on server ID
  • BUG/MEDIUMfilterDisable auto-close on channel during TCP payload filtering
  • BUG/MEDIUMcounterspreserve shared.tg pointer on 'clear counters all'
  • BUG/MINORechreject an ECH store with no usable private key
  • BUG/MINORechpropagate error from load_echkeys()
  • BUG/MINORclido not reject the "/<fd>" form of show fd
  • BUG/MINORcliuse the current argument to parse the FD spec in show fd
  • BUG/MEDIUMproxyfix crash on delete first backend
  • IMPORTcebtreeprivate: fix the duplicate detection in the lookup shortcut
  • BUG/MINORserverfix check reuse-pool in srv_settings_cpy()
  • BUG/MINORserverduplicate server alt_proto in srv_settings_cpy()
  • BUG/MINORserverfix QUIC on server-template
  • MINORserverimprove parsing error for server-template
  • BUG/MAJORssl/ocsplock the OCSP response around reads in the stapling callback
  • BUG/MEDIUMsamplereject the deprecated protobuf group wire types
  • BUG/MEDIUMpeerscheck the available room before encoding dict values
  • BUILDsslDo not use SSL3_MT_KEY_UPDATE, hardcode 24 instead
  • BUG/MEDIUMsslPut CO_ER_SSL_KEYUPDATE at the right place
  • DOCsslDocument tune.ssl.keyupdate-rate-limit
  • MEDIUMsslAdd a way to rate-limit TLSv1.3 KeyUpdate
  • CLEANUPslzclarify that the size promise applies to the stream, not to a call
  • BUG/MINORslzavoid undefined shifts when building the word byte by byte
  • BUG/MINORslzfix the adler32 accumulators signedness on 32-bit
  • BUG/MINORslzdo not append a block to an already finished stream
  • BUG/MEDIUMslzbound the bits wasted by the 9-bit literals
  • BUG/MINORslzuse the exact switch cost for the last literals of a block
  • CLEANUPslzfix the documented worst case size of flush() and finish()
  • BUG/MINORslzdo not read past the end of the input around the match loop
  • BUG/MINORhttp-rulesfix release of a failed set-cookie-fmt redirect rule
  • BUG/MINORhtxTransfer HTX_FL_EOM flag on success in htx_append_msg()
  • BUG/MINORhtxPerform raw copy for messages of same size in htx_copy_msg()
  • BUG/MEDIUMtoolsmake string encoding possible to fail instead of truncating
  • BUG/MINORhttp-htxcheck the strdup() of the lf-string http reply argument
  • BUG/MINORhttp-actreject a negative capture id in the capture actions
  • BUG/MINORhttp-actwork on a copy of the sample in del-headers-bin
  • BUG/MINORhttp-actrestore the response buffer state in the early-hint action
  • BUG/MINORhttp-actfix a double free of the map reference on a parsing error
  • BUG/MINORhttp-actfix a double free of the regex on a rule parsing error
  • BUG/MINORhttp-anafix a one-byte over-read in the client-side cookie parser
  • BUG/MINORh3don't use a block pointer to roll back a partial HTX conversion
  • BUG/MINORh2don't use a block pointer to roll back a partial HTX conversion
  • BUG/MINORh1report the right error position on authority/host mismatch
  • BUG/MINORhttp-htxcheck the trash allocation in http_scheme_based_normalize()
  • BUG/MINORhttpfix an out-of-bounds read in http_get_host_port() on empty host
  • BUG/MINORhttp-fetchfix a NULL channel dereference in smp_fetch_body()
  • BUG/MEDIUMhttp-fetchreject a negative capture id in capture.{req,res}.hdr
  • BUG/MEDIUMhttp-fetchdon't parse a non-HTTP check buffer as an HTX message
  • BUG/MINORhttp-htxfix the length moved when removing a header value
  • BUG/MEDIUMmux-h1Always adjust case for all outgoing headers as expected
  • REORGh1-htxMove h1 headers map in h1-htx
  • DEBUGfdcatch access attempts to closed FDs
  • BUG/MEDIUMsslHandle non-application data record while splicing
  • BUG/MEDIUMsslSpell HAVE_VANILLA_OPENSSL correctly
  • BUG/MEDIUMproxyprotect show errors against backend deletion
  • BUG/MINORresolversdo not index resolvers names in the proxies
  • BUG/MEDIUMserverProperly check for streams before deletion
  • CIhapeeupdate list of modules
  • CIhapeerun modules CI with hapee-maint-3.4r1 branch
  • BUG/MEDIUMproxyprotect show backend against be deletion
  • BUG/MEDIUMproxyprotect show servers ... against backend deletion
  • BUG/MEDIUMproxyprotect show servers ... against server deletion
  • DOCremove outdated experimental mention on dynamic backends
  • DOCfix typo in del ssl ech command
  • BUG/MINORsampleFix bytes() when length it greater than remaining data
  • BUG/MEDIUMsampleAdjust sample size capacity after pointer shift for ltrim()
  • BUG/MEDIUMsampleAdjust sample size capacity after pointer shift for bytes()
  • BUG/MEDIUMnet-helperAdjust sample size capacity after pointer shift
  • BUG/MINORmux-h1Don't delay send if message with c-l was fully sent
  • REGTESTSprotobufadd regression test for nested vs flat paths
  • BUG/MINORsslfix proxy lookup for show ssl sni
  • BUG/MEDIUMprotobuffix nested path bypass in field lookup
  • BUG/MEDIUMprotobufadjust sample size capacity after pointer shift
  • BUG/MEDIUMssl-gencertDon't forget to free memory when done
  • DOCstatsDocument that stats admin is vulnerable to a CSRF attack
  • BUG/MEDIUMstatsEnsure that Origin is valid on POSTs
  • BUG/MEDIUMcachereattach the row when a secondary entry is incomplete
  • DOCstatsdocument the per-proxy byte count fields in the CSV list
  • MINORshctxclamp shctx_row_data_get() reads against the offset
  • BUG/MINORshctxfix shctx_row_data_get() when offset exceeds a block
  • BUG/MEDIUMstatssubject stats admin accesses to stats scope filtering
  • MINORstatsfactor the proxy vs scope check into its own function
  • BUG/MEDIUMappletReenable reads in applet context if requesting a connection
  • BUG/MINORhluaApply socket timeout on server side only
  • MINORhatermadd note about QUIC usage on SSL port
  • BUG/MINORhttp-convMake url-dec failed if no space for trailing null byte
  • BUG/MINORstreamFix custom max-retries initialization when setting backend
  • REGTESTSImprove script testing the set-timeout action
  • BUG/MINORstreamFix custom timeouts initialization when setting backend
  • MEDIUMhtxBe sure size of headers never exceed regular buffer on update
  • MINORhtxAdd a field to save the headers data size
  • BUG/MEDIUMchunkReview chunks usage to not retrieve a large buffer by error
  • MINORchunksAdd function to get a large/regular chunk depending on a buffer
  • BUG/MINORsampleFix a possible underflow on be2hex for large chunk size
  • BUG/MEDIUMtcpcheckAdd proxy used for healthcheck sections in proxies list
  • BUG/MEDIUMfdFix a deadlock when closing other tgroups fds
  • BUG/MINORquicignore STREAM after MUX closure on BE side
  • BUG/MEDIUMmux_quiccomplete stream shutdown for read channel
  • MINORmux_quicuse separate error code for STOP_SENDING
  • BUG/MEDIUMmux_quicdo not free QCS if STOP_SENDING to sent
  • BUG/MINORtrace/quic_frameuse buf, not trace_buf in chunk_frm_appendf()
  • MINORtracealways pretend to use args when disabled
  • MINORcompileradd a macro to ignore all arguments
  • CLEANUPtracesget rid of a few rare empty args in TRACE calls
  • BUILDquicworkaround a gcc bug saying maybe used uninitialized when USE_TRACE=0
  • BUG/MINORmux_quicprevent multiple STOP_SENDING emission per stream
  • BUG/MEDIUMh3fix parser desync on error with multiple frames
  • BUG/MINORhttp-htxDon't by-pass HTX API when merging cookie values
  • BUG/MINORmux-quicFix handling EOM after in qcs_http_rcv_buf()
  • BUG/MAJORhtxDon't swap buffers for empty HTX message with an error
  • BUG/MINORtoolsfix invalid character detection in strl2ic()
  • BUG/MINORinitfix default global settings being overwritten by -G
  • MINORhbufnew lightweight hbuf API
  • BUG/MEDIUMserversUse a refcount for port_range and free it properly
  • BUG/MINORsampleset SMP_F_CONST on srv_name fetch
  • BUG/MEDIUMserverinitialise agent.health in srv_settings_init()
  • BUG/MINORhq-interopsupport transcoding of absolute URI
  • BUG/MINORhq-interopfix transcoding of wrapping response buffer
  • BUG/MEDIUMmux_quicfix memory leak of rx app_buf on stream free
  • BUG/MEDIUMmux-quicDrain the given amount of data in qcs_http_reset_buf()
  • BUG/MEDIUMmux-spopTruly drain outgoing data when the stream is closed
  • BUG/MEDIUMmux-h2Truly drain outgoing HTX data when the stream is closed
  • BUG/MEDIUMmux-fcgiTruly drain outgoing HTX data when the stream is closed
  • REGTESTSquictest H3 request without content-length
  • BUG/MEDIUMh3increment unknown request payload length
  • DOCluaremove incorrect init tags
  • BUG/MINORhq-interopsupport response buffer wrapping
  • BUG/MINORhq-interopsupport full demux buf on large response
  • BUG/MEDIUMhluaProperly report EOS when http applet exits
  • BUG/MINORhq-interopprevent reset if missing content-length
  • BUG/MINORhq-interopreject too big content
  • BUG/MEDIUMmux-fcgifix uint16_t overflow in drl += drp
  • BUG/MEDIUMhttp-actMake a copy of the sample expr in (set/add)-headers-bin
  • BUG/MEDIUMmux_quicfix freeze transfer after QCS rxbuf realign
  • BUG/MINORhpack-tbladd missing NULL check after hpack_dht_defrag()
  • BUG/MEDIUMsslDon't free the early data buffer too early
  • BUG/MINORquicfix rxbuf settings on backend side
  • BUG/MINORmux-h1Properly resolve file path for 'h1-case-adjust-file'
  • BUG/MEDIUMhttp-anaDon't ignore L7 retry errors
  • BUG/MINORhttp-anaRemove a debugging memset on redirect
  • BUG/MINORserverfix add server with consistent hash balancing
  • BUG/MEDIUMh3Properly handle PUSH_PROMISE on backend connections
  • BUG/MINORcpu-topouse ha_diag_notice() to report thread creations
  • MINORerrorsadd ha_diag_notice() to report diag-level notifications
  • BUG/MEDIUMktlsdefer enabling TLS ULP on a socket until connected
  • BUG/MEDIUMacmestuck ACME task when authz is already valid
  • BUG/MINORquicfix Initial length value in sent packets
  • REGTESTSFix log matching in healthcheck-section.vtc
  • BUG/MEDIUMchecksDequeue checks on purge
  • BUG/MINORaclreport ACL not map in ACL ID lookup failures
  • CLEANUPsessionssimplify the sess_priv_conns pool name
  • BUG/MEDIUMxprt_qmuximplement ->get_ssl_sock_ctx() to get the SSL laye
  • BUG/MEDIUMthreadsFiw build when using no thread
  • BUG/MEDIUMregexinitialize the match array earlier during boot
  • REGTESTSchecksAdd script for external healthchecks
  • BUG/MINORtcpcheckOverride external check if healthcheck section is set
  • BUG/MINORmux_quicdo not interrupt recv on error/incomplete data
  • BUG/MEDIUMmux_quicprevent risk of infinite loop on recv
  • BUG/MEDIUMserver/checksSupport healtcheck keyword on default-server lines
  • MINORcheckDon't dump buffers state in check traces for external checks
  • BUG/MEDIUMcheckIgnore small-buffer option when starting an external check
  • BUG/MEDIUMcheckSkip tcpcheck post-config for external checks
  • CLEANUPhapeeremove 51d, deviceatlas and wurfl addons
  • MINORlogadd app_log_raw() and send_log_raw() for binary-safe logging
  • CIhapeeupdate list of modules
  • CIhapeecompile lb with USE_PCRE2
  • CIhapee: add more modules in the CI
  • CIhapee: add more modules in the CI
  • CIhapeename the vtest pipeline
  • CIhapeeadd the SAST to the gitlab-ci dispatcher
  • CIhapeeConfigure SAST in sast.yml
  • CIhapee.gitlab-ci.yml becomes a dispatcher
  • CIhapeetrigger modules in the CI pipeline
  • CIhapeesimple CI that compiles HAProxy
  • MINORhapee/modulesreport the per-stream allocated size for each module
  • BUG/MEDIUMhapeeprevent the module file name being overwritten
  • MEDIUMhapeeHAPEE_MODULE_DECLARE() allows to declare an HAPEE module
  • BUG/MINORhapeeMakefile: bad substitution for MODVERSION variable
  • BUG/MINORhapeerelax __vers symbol check
  • BUG/MINORhapee/modulescan't load modules with USE_OBSOLETE_LINKER
  • BUG/MINORhapeeremove leading \n on __vers error
  • MEDIUMhapeewarn on unsupported initcalls
  • BUG/MINORhapeeforbid to load a module twice
  • HAPEEudpupdate structs and functions required for the UDP module
  • HAPEEmakefileautomatically build objects in addons/hapee_*
  • HAPEEmakefileupdate the cleanup rule to also remove *.i from addons
  • HAPEEaddonsquic CID in -vv
  • HAPEEaddonsadds quic CID generator to interop with packetshield
  • MEDIUMhapeedoes not pass OPTION_LDFLAGS to modules
  • MINORhapee/modulescheck if we generate the API hash correctly
  • BUG/MINORhapee/modulesadjust include match() in gen-modules-config-h.awk
  • BUG/MINORhapee/modulesinitialize the module head list
  • BUILDhapee/modulesselect either md5 or md5sum
  • MEDIUMhapee/modulesload the STG_REGISTER initcalls
  • BUG/MINORhapee/modulesdisplay detailed error message on mod_init() failure
  • MINORhapee/modulesadd a new label MODULES_LOCK to the lock_label enum
  • MINORhapee/modulesadd the ability to register variable and functions.
  • MEDIUMhapee/modules'modules list' on the cli shows currently loaded modules
  • MINORhapee/modulesterminate properly loaded modules if possible
  • MEDIUMhapee/modulesadd memory reservation support for the modules
  • BUILDhapee/modulesupdate HAPEE version macro to 3.4r1
  • BUILDhapee/modulesadd macros to compute numerical value of a HAPEE version
  • BUILDhapee/modulesadd version of the module in the defines
  • MEDIUMhapee/modulesadd modules support
×

About the new layout

For 2025, we're happy to introduce a redesigned HAProxy Configuration Manual!

The new manual enhances the user experience by providing more help for keywords, including more details about context, usage, and syntax. New search filters help you find keywords faster, with separate coverage for each variant.

If you would prefer to use the older layout click here.