Subject: bug#863: haproxy forward upgrade and connection headers as default (h2c request smuggling)

From: gr0 bUst4 <[email-masked]>
Date: Mon, 28 Oct 2024 10:32:09 +0000

Package: haproxy

Version: 2.6.12-1

suggest to fix this default forwarding

-------- Message transféré --------
Sujet : 	Re: CVE request: headers forward can lead to h2c request 
smuggling (fwd)
Date : 	Mon, 28 Oct 2024 07:08:40 +0100
De : 	Willy TARREAU <[email-masked]>
Pour : 	[email-masked]

Hello,

Thanks for contacting us!

> i did a CVE request about HAProxy and the default forward of the headers
> upgrade and connection which can lead to an h2c request smuggling or a
> web-socket smuggling.
>
> The CVE request is just about h2c (over clear text) i didn't POC 
> enough for
> the web-socket smuggling.
>
> I'll appreciate to talk about this with you.

I guess you're speaking about this commit:

7b89aa5b19 ("BUG/MINOR: h1: do not forward h2c upgrade header token")

If so, it's already backported for next stable releases:
3.0: cba44958ae
2.9: cf31943d74

If not, do not hesitate to share details about your concerns.

Thanks,
Willy

---

From: Mark Hindley <[email-masked]>
Date: Mon, 28 Oct 2024 19:27:55 +0000

Control: tags -1 debian

> suggest to fix this default forwarding

Devuan uses Debian's haproxy packages directly without recompilation. So when
this is fixed in Debian it will be inherited by Devuan.

>    If so, it's already backported for next stable releases:

haproxy    | 2.9.11-1                | testing                  | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 2.9.11-1                | unstable                 | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 2.9.11-1                | unstable-debug           | source
haproxy    | 3.0.5-1                 | experimental             | source, amd64, arm64, armel, armhf, i386, mips64el, ppc64el, riscv64, s390x
haproxy    | 3.0.5-1                 | experimental-debug       | source

Mark

---

From: "Devuan bug Tracking System" <[email-masked]>
Date: Sat, 11 Oct 2025 11:16:02 +0000

This is an automatic notification regarding your bug report
which was filed against the haproxy package:

#863: haproxy forward upgrade and connection headers as default (h2c request smuggling)

It has been closed by Mark Hindley <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mark Hindley <[email-masked]> by
replying to this email.

-- 
863: https://bugs.devuan.org/cgi/bugreport.cgi?bug=863
Devuan Bug Tracking System
Contact [email-masked] with problems

Subject: Upstream fix now in Debian
From: Mark Hindley <[email-masked]>
To: [email-masked]
Date: Sat, 11 Oct 2025 12:14:41 +0100

Version: 3.0.9-1

Closing.

Mark

Subject: haproxy forward upgrade and connection headers as default (h2c request smuggling)
From: gr0 bUst4 <[email-masked]>
To: [email-masked]
Date: Mon, 28 Oct 2024 10:32:09 +0000

Package: haproxy

Version: 2.6.12-1

-------- Message transféré --------

Hello,

Thanks,
Willy