SUSE-SU-2026:2651-1

Details

Description of the patch:

This update for haproxy fixes the following issues

CVE-2026-55203: integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record headers (bsc#1268557).
CVE-2026-55204: null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c (bsc#1268558).

Affected Packages

haproxy

SUSE Linux Enterprise High Availability Extension 15 SP4SUSE Linux Enterprise High Availability Extension 15 SP5SUSE Linux Enterprise Micro 5.3SUSE Linux Enterprise Micro 5.4SUSE Linux Enterprise Micro 5.5

Fixed in:

2.4.22+git0.f8e3218e2-150400.3.28.1

References

ADVISORY

https://bugzilla.suse.com/1268557

ADVISORY

https://bugzilla.suse.com/1268558

ADVISORY

https://lists.suse.com/pipermail/sle-updates/2026-June/047661.html

ADVISORY

https://www.suse.com/security/cve/CVE-2026-55203/

ADVISORY

https://www.suse.com/security/cve/CVE-2026-55204/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2026/suse-su-20262651-1/