!171 fix CVE-2025-32464

From: @xinghe_1 Reviewed-by: @jiangheng12 Signed-off-by: @jiangheng12
fix CVE-2025-32464
2025-04-29 07:48:27 +00:00 · 2025-04-29 14:59:21 +08:00 · 2025-03-20 03:53:06 +00:00 · 2025-03-17 10:42:32 +00:00 · 2024-12-10 07:13:07 +00:00 · 2024-12-10 14:18:36 +08:00
9 changed files with 944 additions and 1 deletions
--- a/CVE-2024-49214.patch
+++ b/CVE-2024-49214.patch
@ -0,0 +1,458 @@
+From fe5685af820ae62fe5b0d80b5ed7a2ffc41a036f Mon Sep 17 00:00:00 2001
+From: Frederic Lecaille <flecaille@haproxy.com>
+Date: Fri, 30 Aug 2024 15:38:54 +0200
+Subject: [PATCH] BUG/MEDIUM: quic: always validate sender address on 0-RTT
+
+It has been reported by Wedl Michael, a student at the University of Applied
+Sciences St. Poelten, a potential vulnerability into haproxy as described below.
+
+An attacker could have obtained a TLS session ticket after having established
+a connection to an haproxy QUIC listener, using its real IP address. The
+attacker has not even to send a application level request (HTTP3). Then
+the attacker could open a 0-RTT session with a spoofed IP address
+trusted by the QUIC listen to bypass IP allow/block list and send HTTP3 requests.
+
+To mitigate this vulnerability, one decided to use a token which can be provided
+to the client each time it successfully managed to connect to haproxy. These
+tokens may be reused for future connections to validate the address/path of the
+remote peer as this is done with the Retry token which is used for the current
+connection, not the next one. Such tokens are transported by NEW_TOKEN frames
+which was not used at this time by haproxy.
+
+So, each time a client connect to an haproxy QUIC listener with 0-RTT
+enabled, it is provided with such a token which can be reused for the
+next 0-RTT session. If no such a token is presented by the client,
+haproxy checks if the session is a 0-RTT one, so with early-data presented
+by the client. Contrary to the Retry token, the decision to refuse the
+connection is made only when the TLS stack has been provided with
+enough early-data from the Initial ClientHello TLS message and when
+these data have been accepted. Hopefully, this event arrives fast enough
+to allow haproxy to kill the connection if some early-data have been accepted
+without token presented by the client.
+
+quic_build_post_handshake_frames() has been modified to build a NEW_TOKEN
+frame with this newly implemented token to be transported inside.
+
+quic_tls_derive_retry_token_secret() was renamed to quic_do_tls_derive_token_secre()
+and modified to be reused and derive the secret for the new token implementation.
+
+quic_token_validate() has been implemented to validate both the Retry and
+the new token implemented by this patch. When this is a non-retry token
+which could not be validated, the datagram received is marked as requiring
+a Retry packet to be sent, and no connection is created.
+
+When the Initial packet does not embed any non-retry token and if 0-RTT is enabled
+the connection is marked with this new flag: QUIC_FL_CONN_NO_TOKEN_RCVD. As soon
+as the TLS stack detects that some early-data have been provided and accepted by
+the client, the connection is marked to be killed (QUIC_FL_CONN_TO_KILL) from
+ha_quic_add_handshake_data(). This is done calling qc_ssl_eary_data_accepted()
+new function. The secret TLS handshake is interrupted as soon as possible returnin
+0 from ha_quic_add_handshake_data(). The connection is also marked as
+requiring a Retry packet to be sent (QUIC_FL_CONN_SEND_RETRY) from
+ha_quic_add_handshake_data(). The the handshake I/O handler (quic_conn_io_cb())
+knows how to behave: kill the connection after having sent a Retry packet.
+
+About TLS stack compatibility, this patch is supported by aws-lc. It is
+disabled for wolfssl which does not support 0-RTT at this time thanks
+to HAVE_SSL_0RTT_QUIC.
+
+This patch depends on these commits:
+
+     MINOR: quic: Add trace for QUIC_EV_CONN_IO_CB event.
+     MINOR: quic: Implement qc_ssl_eary_data_accepted().
+     MINOR: quic: Modify NEW_TOKEN frame structure (qf_new_token struct)
+     BUG/MINOR: quic: Missing incrementation in NEW_TOKEN frame builder
+     MINOR: quic: Token for future connections implementation.
+     MINOR: quic: Implement quic_tls_derive_token_secret().
+     MINOR: tools: Implement ipaddrcpy().
+
+Must be backported as far as 2.6.
+
+(cherry picked from commit f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46)
+[fl: Add ->flags to quic_dgram struct (would arrive with quic_initial feature).
+     Add QUIC_DGRAM_FL_ quic_dgram flags (would arrive with quic_initial feature).
+     Modify quic_rx_pkt_retrieve_conn() to fix a compilation issue and correctly
+     handle the "if (pkt->token_len) {}" else block to do so with quic_initial
+     feature]
+Signed-off-by: Frederic Lecaille <flecaille@haproxy.com>
+(cherry picked from commit e875aa59a9216d42639b802b5008afc733e4c940)
+[wt: move QUIC_CONN_FL_* upper in quic_conn-t.h; ctx adj in quic_dgram;
+     include quic_cid-t for struct quic_cid in quic_rx-t.h]
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+---
+ include/haproxy/quic_conn-t.h |    3 ++
+ include/haproxy/quic_rx-t.h   |    2 ++
+ include/haproxy/quic_sock-t.h |    5 +++
+ src/quic_conn.c               |   65 ++++++++++++++++++++++++++++++---
+ src/quic_retry.c              |    8 +----
+ src/quic_rx.c                 |   80 +++++++++++++++++++++++++++++++++++------
+ src/quic_sock.c               |    2 ++
+ src/quic_ssl.c                |   20 ++++++++++-
+ 8 files changed, 161 insertions(+), 24 deletions(-)
+
+diff --git a/include/haproxy/quic_conn-t.h b/include/haproxy/quic_conn-t.h
+index a126e04..382454c 100644
+--- a/include/haproxy/quic_conn-t.h
+++ b/include/haproxy/quic_conn-t.h
+@@ -291,6 +291,9 @@ struct quic_conn_cntrs {
+ #define QUIC_FL_CONN_IPKTNS_DCD                  (1U << 15) /* Initial packet number space discarded  */
+ #define QUIC_FL_CONN_HPKTNS_DCD                  (1U << 16) /* Handshake packet number space discarded  */
+ #define QUIC_FL_CONN_PEER_VALIDATED_ADDR         (1U << 17) /* Peer address is considered as validated for this connection. */
+#define QUIC_FL_CONN_NO_TOKEN_RCVD               (1U << 18) /* Client dit not send any token */
+#define QUIC_FL_CONN_SEND_RETRY                  (1U << 19) /* A send retry packet must be sent */
+/* gap here */
+ #define QUIC_FL_CONN_TO_KILL                     (1U << 24) /* Unusable connection, to be killed */
+ #define QUIC_FL_CONN_TX_TP_RECEIVED              (1U << 25) /* Peer transport parameters have been received (used for the transmitting part) */
+ #define QUIC_FL_CONN_FINALIZED                   (1U << 26) /* QUIC connection finalized (functional, ready to send/receive) */
+diff --git a/include/haproxy/quic_rx-t.h b/include/haproxy/quic_rx-t.h
+index 9ef8e7a..e77755b 100644
+--- a/include/haproxy/quic_rx-t.h
+++ b/include/haproxy/quic_rx-t.h
+@@ -1,6 +1,8 @@
+ #ifndef _HAPROXY_RX_T_H
+ #define _HAPROXY_RX_T_H
+ 
+#include <haproxy/quic_cid-t.h>
+
+ extern struct pool_head *pool_head_quic_conn_rxbuf;
+ extern struct pool_head *pool_head_quic_dgram;
+ extern struct pool_head *pool_head_quic_rx_packet;
+diff --git a/include/haproxy/quic_sock-t.h b/include/haproxy/quic_sock-t.h
+index 67a5749..83ab32f 100644
+--- a/include/haproxy/quic_sock-t.h
+++ b/include/haproxy/quic_sock-t.h
+@@ -25,6 +25,9 @@ struct quic_receiver_buf {
+ 	struct mt_list rxbuf_el; /* list element into receiver.rxbuf_list. */
+ };
+ 
+#define QUIC_DGRAM_FL_REJECT                   0x00000001
+#define QUIC_DGRAM_FL_SEND_RETRY               0x00000002
+
+ /* QUIC datagram */
+ struct quic_dgram {
+ 	void *owner;
+@@ -38,6 +41,8 @@ struct quic_dgram {
+ 
+ 	struct list recv_list; /* elemt to quic_receiver_buf <dgram_list>. */
+ 	struct mt_list handler_list; /* elem to quic_dghdlr <dgrams>. */
+
+	int flags; /* QUIC_DGRAM_FL_* values */
+ };
+ 
+ /* QUIC datagram handler */
+diff --git a/src/quic_conn.c b/src/quic_conn.c
+index cb56fbe..d9808d2 100644
+--- a/src/quic_conn.c
+++ b/src/quic_conn.c
+@@ -56,6 +56,7 @@
+ #include <haproxy/quic_sock.h>
+ #include <haproxy/quic_stats.h>
+ #include <haproxy/quic_stream.h>
+#include <haproxy/quic_token.h>
+ #include <haproxy/quic_tp.h>
+ #include <haproxy/quic_trace.h>
+ #include <haproxy/quic_tx.h>
+@@ -478,6 +479,30 @@ int quic_build_post_handshake_frames(struct quic_conn *qc)
+ 		}
+ 
+ 		LIST_APPEND(&frm_list, &frm->list);
+
+#ifdef HAVE_SSL_0RTT_QUIC
+		if (qc->li->bind_conf->ssl_conf.early_data) {
+			size_t new_token_frm_len;
+
+			frm = qc_frm_alloc(QUIC_FT_NEW_TOKEN);
+			if (!frm) {
+				TRACE_ERROR("frame allocation error", QUIC_EV_CONN_IO_CB, qc);
+				goto leave;
+			}
+
+			new_token_frm_len =
+				quic_generate_token(frm->new_token.data,
+				                    sizeof(frm->new_token.data), &qc->peer_addr);
+			if (!new_token_frm_len) {
+				TRACE_ERROR("token generation failed", QUIC_EV_CONN_IO_CB, qc);
+				goto leave;
+			}
+
+			BUG_ON(new_token_frm_len != sizeof(frm->new_token.data));
+			frm->new_token.len = new_token_frm_len;
+			LIST_APPEND(&frm_list, &frm->list);
+		}
+#endif
+ 	}
+ 
+ 	/* Initialize <max> connection IDs minus one: there is
+@@ -759,6 +784,11 @@ struct task *quic_conn_io_cb(struct task *t, void *context, unsigned int state)
+ 		qc_ssl_provide_all_quic_data(qc, qc->xprt_ctx);
+ 	}
+ 
+	if (qc->flags & QUIC_FL_CONN_TO_KILL) {
+		TRACE_DEVEL("connection to be killed", QUIC_EV_CONN_PHPKTS, qc);
+		goto out;
+	}
+
+ 	/* Retranmissions */
+ 	if (qc->flags & QUIC_FL_CONN_RETRANS_NEEDED) {
+ 		TRACE_DEVEL("retransmission needed", QUIC_EV_CONN_PHPKTS, qc);
+@@ -872,7 +902,25 @@ struct task *quic_conn_io_cb(struct task *t, void *context, unsigned int state)
+ 		quic_nictx_free(qc);
+ 	}
+ 
+-	if ((qc->flags & QUIC_FL_CONN_CLOSING) && qc->mux_state != QC_MUX_READY) {
+	if (qc->flags & QUIC_FL_CONN_SEND_RETRY) {
+		struct quic_counters *prx_counters;
+		struct proxy *prx = qc->li->bind_conf->frontend;
+		struct quic_rx_packet pkt = {
+			.scid = qc->dcid,
+			.dcid = qc->odcid,
+		};
+
+		prx_counters = EXTRA_COUNTERS_GET(prx->extra_counters_fe, &quic_stats_module);
+		if (send_retry(qc->li->rx.fd, &qc->peer_addr, &pkt, qc->original_version)) {
+			TRACE_ERROR("Error during Retry generation",
+			            QUIC_EV_CONN_LPKT, NULL, NULL, NULL, qc->original_version);
+		}
+		else
+			HA_ATOMIC_INC(&prx_counters->retry_sent);
+	}
+
+	if ((qc->flags & (QUIC_FL_CONN_CLOSING|QUIC_FL_CONN_TO_KILL)) &&
+	    qc->mux_state != QC_MUX_READY) {
+ 		quic_conn_release(qc);
+ 		qc = NULL;
+ 	}
+@@ -979,11 +1027,15 @@ struct task *qc_process_timer(struct task *task, void *ctx, unsigned int state)
+  * for QUIC servers (or haproxy listeners).
+  * <dcid> is the destination connection ID, <scid> is the source connection ID.
+  * This latter <scid> CID as the same value on the wire as the one for <conn_id>
+- * which is the first CID of this connection but a different internal representation used to build
+ * which is the first CID of this connection but a different internal
+ * representation used to build
+  * NEW_CONNECTION_ID frames. This is the responsibility of the caller to insert
+  * <conn_id> in the CIDs tree for this connection (qc->cids).
+- * <token> is the token found to be used for this connection with <token_len> as
+- * length. Endpoints addresses are specified via <local_addr> and <peer_addr>.
+ * <token> is a boolean denoting if a token was received for this connection
+ * from an Initial packet.
+ * <token_odcid> is the original destination connection ID which was embedded
+ * into the Retry token sent to the client before instantiated this connection.
+ * Endpoints addresses are specified via <local_addr> and <peer_addr>.
+  * Returns the connection if succeeded, NULL if not.
+  */
+ struct quic_conn *qc_new_conn(const struct quic_version *qv, int ipv4,
+@@ -1090,6 +1142,9 @@ struct quic_conn *qc_new_conn(const struct quic_version *qv, int ipv4,
+ 		qc->prx_counters = EXTRA_COUNTERS_GET(prx->extra_counters_fe,
+ 		                                      &quic_stats_module);
+ 		qc->flags = QUIC_FL_CONN_LISTENER;
+		/* Mark this connection as having not received any token when 0-RTT is enabled. */
+		if (l->bind_conf->ssl_conf.early_data && !token)
+			qc->flags |= QUIC_FL_CONN_NO_TOKEN_RCVD;
+ 		qc->state = QUIC_HS_ST_SERVER_INITIAL;
+ 		/* Copy the client original DCID. */
+ 		qc->odcid = *dcid;
+@@ -1112,7 +1167,7 @@ struct quic_conn *qc_new_conn(const struct quic_version *qv, int ipv4,
+ 	/* If connection is instantiated due to an INITIAL packet with an
+ 	 * already checked token, consider the peer address as validated.
+ 	 */
+-	if (token_odcid->len) {
+	if (token) {
+ 		TRACE_STATE("validate peer address due to initial token",
+ 		            QUIC_EV_CONN_INIT, qc);
+ 		qc->flags |= QUIC_FL_CONN_PEER_VALIDATED_ADDR;
+diff --git a/src/quic_retry.c b/src/quic_retry.c
+index 2d6ea31..78ef88a 100644
+--- a/src/quic_retry.c
+++ b/src/quic_retry.c
+@@ -258,17 +258,11 @@ int quic_retry_token_check(struct quic_rx_packet *pkt,
+ 	TRACE_ENTER(QUIC_EV_CONN_LPKT, qc);
+ 
+ 	/* The caller must ensure this. */
+-	BUG_ON(!pkt->token_len);
+	BUG_ON(!pkt->token_len || *pkt->token != QUIC_TOKEN_FMT_RETRY);
+ 
+ 	prx = l->bind_conf->frontend;
+ 	prx_counters = EXTRA_COUNTERS_GET(prx->extra_counters_fe, &quic_stats_module);
+ 
+-	if (*pkt->token != QUIC_TOKEN_FMT_RETRY) {
+-		/* TODO: New token check */
+-		TRACE_PROTO("Packet dropped", QUIC_EV_CONN_LPKT, qc, NULL, NULL, pkt->version);
+-		goto leave;
+-	}
+-
+ 	if (sizeof buf < tokenlen) {
+ 		TRACE_ERROR("too short buffer", QUIC_EV_CONN_LPKT, qc);
+ 		goto err;
+diff --git a/src/quic_rx.c b/src/quic_rx.c
+index 7bc5844..81eaa69 100644
+--- a/src/quic_rx.c
+++ b/src/quic_rx.c
+@@ -26,6 +26,7 @@
+ #include <haproxy/quic_stream.h>
+ #include <haproxy/quic_ssl.h>
+ #include <haproxy/quic_tls.h>
+#include <haproxy/quic_token.h>
+ #include <haproxy/quic_trace.h>
+ #include <haproxy/quic_tx.h>
+ #include <haproxy/ssl_sock.h>
+@@ -1587,6 +1588,47 @@ static inline int quic_padding_check(const unsigned char *pos,
+ 	return pos == end;
+ }
+ 
+/* Validate the token, retry or not (provided by NEW_TOKEN) parsed into
+ * <pkt> RX packet from <dgram> datagram.
+ * Return 1 if succeded, 0 if not.
+ */
+static inline int quic_token_validate(struct quic_rx_packet *pkt,
+                                      struct quic_dgram *dgram,
+                                      struct listener *l, struct quic_conn *qc,
+                                      struct quic_cid *odcid)
+{
+	int ret = 0;
+
+	TRACE_ENTER(QUIC_EV_CONN_LPKT, qc);
+
+	switch (*pkt->token) {
+	case QUIC_TOKEN_FMT_RETRY:
+		ret = quic_retry_token_check(pkt, dgram, l, qc, odcid);
+		break;
+	case QUIC_TOKEN_FMT_NEW:
+		ret = quic_token_check(pkt, dgram, qc);
+		if (!ret) {
+			/* Fallback to a retry token in case of any error. */
+			dgram->flags |= QUIC_DGRAM_FL_SEND_RETRY;
+		}
+		break;
+	default:
+		TRACE_PROTO("Packet dropped", QUIC_EV_CONN_LPKT, qc, NULL, NULL, pkt->version);
+		break;
+	}
+
+	if (!ret)
+		goto err;
+
+	ret = 1;
+ leave:
+	TRACE_LEAVE(QUIC_EV_CONN_LPKT, qc);
+	return ret;
+ err:
+	TRACE_DEVEL("leaving in error", QUIC_EV_CONN_LPKT, qc);
+	goto leave;
+}
+
+ /* Find the associated connection to the packet <pkt> or create a new one if
+  * this is an Initial packet. <dgram> is the datagram containing the packet and
+  * <l> is the listener instance on which it was received.
+@@ -1645,22 +1687,38 @@ static struct quic_conn *quic_rx_pkt_retrieve_conn(struct quic_rx_packet *pkt,
+ 			}
+ 
+ 			if (pkt->token_len) {
+-				/* Validate the token only when connection is unknown. */
+-				if (!quic_retry_token_check(pkt, dgram, l, qc, &token_odcid))
+				TRACE_PROTO("Initial with token", QUIC_EV_CONN_LPKT, NULL, NULL, NULL, pkt->version);
+				/* Validate the token, retry or not only when connection is unknown. */
+				if (!quic_token_validate(pkt, dgram, l, qc, &token_odcid)) {
+					if (dgram->flags & QUIC_DGRAM_FL_SEND_RETRY) {
+						if (send_retry(l->rx.fd, &dgram->saddr, pkt, pkt->version)) {
+							TRACE_ERROR("Error during Retry generation",
+							            QUIC_EV_CONN_LPKT, NULL, NULL, NULL, pkt->version);
+						}
+						else
+							HA_ATOMIC_INC(&prx_counters->retry_sent);
+
+						goto out;
+					}
+
+ 					goto err;
+				}
+ 			}
+-			else if (!(l->bind_conf->options & BC_O_QUIC_FORCE_RETRY) &&
+-			         HA_ATOMIC_LOAD(&prx_counters->half_open_conn) >= global.tune.quic_retry_threshold) {
+-				TRACE_PROTO("Initial without token, sending retry",
+-				            QUIC_EV_CONN_LPKT, NULL, NULL, NULL, pkt->version);
+-				if (send_retry(l->rx.fd, &dgram->saddr, pkt, pkt->version)) {
+-					TRACE_ERROR("Error during Retry generation",
+			else {
+				TRACE_PROTO("Initial without token", QUIC_EV_CONN_LPKT, NULL, NULL, NULL, pkt->version);
+				if (!(l->bind_conf->options & BC_O_QUIC_FORCE_RETRY) &&
+				    HA_ATOMIC_LOAD(&prx_counters->half_open_conn) >= global.tune.quic_retry_threshold) {
+					TRACE_PROTO("Initial without token, sending retry",
+ 					            QUIC_EV_CONN_LPKT, NULL, NULL, NULL, pkt->version);
+					if (send_retry(l->rx.fd, &dgram->saddr, pkt, pkt->version)) {
+						TRACE_ERROR("Error during Retry generation",
+									QUIC_EV_CONN_LPKT, NULL, NULL, NULL, pkt->version);
+						goto out;
+					}
+
+					HA_ATOMIC_INC(&prx_counters->retry_sent);
+ 					goto out;
+ 				}
+-
+-				HA_ATOMIC_INC(&prx_counters->retry_sent);
+-				goto out;
+ 			}
+ 
+ 			/* RFC 9000 7.2. Negotiating Connection IDs:
+diff --git a/src/quic_sock.c b/src/quic_sock.c
+index 7a18bac..6713bdb 100644
+--- a/src/quic_sock.c
+++ b/src/quic_sock.c
+@@ -292,6 +292,7 @@ static int quic_lstnr_dgram_dispatch(unsigned char *pos, size_t len, void *owner
+ 	dgram->saddr = *saddr;
+ 	dgram->daddr = *daddr;
+ 	dgram->qc = NULL;
+	dgram->flags = 0;
+ 
+ 	/* Attached datagram to its quic_receiver_buf and quic_dghdlrs. */
+ 	LIST_APPEND(dgrams, &dgram->recv_list);
+@@ -778,6 +779,7 @@ int qc_rcv_buf(struct quic_conn *qc)
+ 		new_dgram->saddr = saddr;
+ 		new_dgram->daddr = daddr;
+ 		new_dgram->qc = NULL;  /* set later via quic_dgram_parse() */
+		new_dgram->flags = 0;
+ 
+ 		TRACE_DEVEL("read datagram", QUIC_EV_CONN_RCV, qc, new_dgram);
+ 
+diff --git a/src/quic_ssl.c b/src/quic_ssl.c
+index 73bf8dc..b48494e 100644
+--- a/src/quic_ssl.c
+++ b/src/quic_ssl.c
+@@ -354,6 +354,23 @@ static int ha_quic_add_handshake_data(SSL *ssl, enum ssl_encryption_level_t leve
+ 
+ 	TRACE_ENTER(QUIC_EV_CONN_ADDDATA, qc);
+ 
+	TRACE_PROTO("ha_quic_add_handshake_data() called", QUIC_EV_CONN_IO_CB, qc, NULL, ssl);
+
+#ifdef HAVE_SSL_0RTT_QUIC
+	/* Detect asap if some 0-RTT data were accepted for this connection.
+	 * If this is the case and no token was provided, interrupt the useless
+	 * secrets derivations. A Retry packet must be sent, and this connection
+	 * must be killed.
+	 * Note that QUIC_FL_CONN_NO_TOKEN_RCVD is possibly set only for when 0-RTT is
+	 * enabled for the connection.
+	 */
+	if ((qc->flags & QUIC_FL_CONN_NO_TOKEN_RCVD) && qc_ssl_eary_data_accepted(ssl)) {
+		TRACE_PROTO("connection to be killed", QUIC_EV_CONN_ADDDATA, qc);
+		qc->flags |= QUIC_FL_CONN_TO_KILL|QUIC_FL_CONN_SEND_RETRY;
+		goto leave;
+	}
+#endif
+
+ 	if (qc->flags & QUIC_FL_CONN_TO_KILL) {
+ 		TRACE_PROTO("connection to be killed", QUIC_EV_CONN_ADDDATA, qc);
+ 		goto out;
+@@ -528,9 +545,10 @@ int qc_ssl_provide_quic_data(struct ncbuf *ncbuf,
+ 	state = qc->state;
+ 	if (state < QUIC_HS_ST_COMPLETE) {
+ 		ssl_err = SSL_do_handshake(ctx->ssl);
+		TRACE_PROTO("SSL_do_handshake() called", QUIC_EV_CONN_IO_CB, qc, NULL, ctx->ssl);
+ 
+ 		if (qc->flags & QUIC_FL_CONN_TO_KILL) {
+-			TRACE_DEVEL("connection to be killed", QUIC_EV_CONN_IO_CB, qc);
+			TRACE_DEVEL("connection to be killed", QUIC_EV_CONN_IO_CB, qc, &state, ctx->ssl);
+ 			goto leave;
+ 		}
+ 
+-- 
+1.7.10.4
+
--- a/CVE-2024-53008-1.patch
+++ b/CVE-2024-53008-1.patch
@ -0,0 +1,77 @@
+From 87fefebfbe3df218103502046a0871b235a48087 Mon Sep 17 00:00:00 2001
+From: Amaury Denoyelle <adenoyelle@haproxy.com>
+Date: Fri, 28 Jun 2024 10:43:19 +0200
+Subject: [PATCH] BUG/MEDIUM: h3: ensure the ":method" pseudo header is totally
+ valid
+Origin: https://github.com/haproxy/haproxy/commit/87fefebfbe3df218103502046a0871b235a48087
+
+Ensure pseudo-header method is only constitued of valid characters
+according to RFC 9110. If an invalid value is found, the request is
+rejected and stream is resetted.
+
+Previously only characters forbidden in headers were rejected (NUL/CR/LF),
+but this is insufficient for :method, where some other forbidden chars
+might be used to trick a non-compliant backend server into seeing a
+different path from the one seen by haproxy. Note that header injection
+is not possible though.
+
+This must be backported up to 2.6.
+
+Many thanks to Yuki Mogi of FFRI Security Inc for the detailed report
+that allowed to quicky spot, confirm and fix the problem.
+
+(cherry picked from commit 789d4abd7328f0a745d67698e89bbb888d4d9b2c)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+(cherry picked from commit 47d13c68cf198467a94e85a1caa44484a1e2e75c)
+[cf: adapted]
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+---
+ include/haproxy/http.h | 15 +++++++++++++++
+ src/h3.c               |  8 ++++++++
+ 2 files changed, 23 insertions(+)
+
+diff --git a/include/haproxy/http.h b/include/haproxy/http.h
+index 299264051d28e..a297fa59b444a 100644
+--- a/include/haproxy/http.h
+++ b/include/haproxy/http.h
+@@ -192,6 +192,21 @@ static inline int http_header_has_forbidden_char(const struct ist ist, const cha
+ 	return 0;
+ }
+ 
+/* Check that method only contains token as required.
+ * See RFC 9110 9. Methods
+ */
+static inline int http_method_has_forbidden_char(const struct ist ist)
+{
+	const char *start = istptr(ist);
+
+	do {
+		if (!HTTP_IS_TOKEN(*start))
+			return 1;
+		start++;
+	} while (start < istend(ist));
+	return 0;
+}
+
+ /* Looks into <ist> for forbidden characters for :path values (0x00..0x1F,
+  * 0x20, 0x23), starting at pointer <start> which must be within <ist>.
+  * Returns non-zero if such a character is found, 0 otherwise. When run on
+diff --git a/src/h3.c b/src/h3.c
+index 9e415b3b56303..4e21f6b92f535 100644
+--- a/src/h3.c
+++ b/src/h3.c
+@@ -625,6 +625,14 @@ static ssize_t h3_headers_to_htx(struct qcs *qcs, const struct buffer *buf,
+ 				len = -1;
+ 				goto out;
+ 			}
+
+			if (!istlen(list[hdr_idx].v) || http_method_has_forbidden_char(list[hdr_idx].v)) {
+				TRACE_ERROR("invalid method pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
+				h3s->err = H3_MESSAGE_ERROR;
+				len = -1;
+				goto out;
+			}
+
+ 			meth = list[hdr_idx].v;
+ 		}
+ 		else if (isteq(list[hdr_idx].n, ist(":path"))) {
--- a/CVE-2024-53008-2.patch
+++ b/CVE-2024-53008-2.patch
@ -0,0 +1,45 @@
+From 6748a47819c263d4631187b6f121b5344ab50d57 Mon Sep 17 00:00:00 2001
+From: Amaury Denoyelle <adenoyelle@haproxy.com>
+Date: Fri, 28 Jun 2024 10:50:19 +0200
+Subject: [PATCH] BUG/MEDIUM: h3: ensure the ":scheme" pseudo header is totally
+ valid
+Origin: https://github.com/haproxy/haproxy/commit/6748a47819c263d4631187b6f121b5344ab50d57
+
+Ensure pseudo-header scheme is only constitued of valid characters
+according to RFC 9110. If an invalid value is found, the request is
+rejected and stream is resetted.
+
+It's the same as for previous commit "BUG/MEDIUM: h3: ensure the
+":method" pseudo header is totally valid" except that this time it
+applies to the ":scheme" pseudo header.
+
+This must be backported up to 2.6.
+
+(cherry picked from commit a3bed52d1f84ba36af66be4317a5f746d498bdf4)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+(cherry picked from commit 5ddc4004cb0c3c4ea4f4596577c85f004678e9c0)
+[cf: adapted]
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+---
+ src/h3.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/h3.c b/src/h3.c
+index 4e21f6b92f535..1984f984f7daf 100644
+--- a/src/h3.c
+++ b/src/h3.c
+@@ -666,6 +666,14 @@ static ssize_t h3_headers_to_htx(struct qcs *qcs, const struct buffer *buf,
+ 				len = -1;
+ 				goto out;
+ 			}
+
+			if (!http_validate_scheme(list[hdr_idx].v)) {
+				TRACE_ERROR("invalid scheme pseudo-header", H3_EV_RX_FRAME|H3_EV_RX_HDR, qcs->qcc->conn, qcs);
+				h3s->err = H3_MESSAGE_ERROR;
+				len = -1;
+				goto out;
+			}
+
+ 			scheme = list[hdr_idx].v;
+ 		}
+ 		else if (isteq(list[hdr_idx].n, ist(":authority"))) {
--- a/backport-BUG-MEDIUM-queue-Make-process_srv_queue-return-the-n.patch
+++ b/backport-BUG-MEDIUM-queue-Make-process_srv_queue-return-the-n.patch
@ -0,0 +1,87 @@
+From 4fb445fe5769172354d08f4a726f99e9815494c1 Mon Sep 17 00:00:00 2001
+From: Olivier Houchard <ohouchard@haproxy.com>
+Date: Mon, 23 Dec 2024 14:17:25 +0000
+Subject: [PATCH] BUG/MEDIUM: queue: Make process_srv_queue return the number
+ of streams
+
+Make process_srv_queue() return the number of streams unqueued, as
+pendconn_grab_from_px() did, as that number is used by
+srv_update_status() to generate logs.
+
+This should be backported up to 2.6 with
+111ea83ed4e13ac3ab028ed5e95201a1b4aa82b8
+
+(cherry picked from commit 5b8899b6ccc7dab3a54a51dcb8ba1512bd0c886c)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+(cherry picked from commit 70588a16903002709cf3c84255ad8ded73f8e584)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+(cherry picked from commit 365378bfdf283650ce1ac152348ca59b6d4c32c1)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+
+Conflict:NA
+Reference:https://git.haproxy.org/?p=haproxy-2.9.git;a=patch;h=4fb445fe5769172354d08f4a726f99e9815494c1
+---
+ include/haproxy/queue.h |    2 +-
+ src/queue.c             |    3 ++-
+ src/server.c            |    4 ++--
+ 3 files changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/include/haproxy/queue.h b/include/haproxy/queue.h
+index e4201fb..4896f71 100644
+--- a/include/haproxy/queue.h
+++ b/include/haproxy/queue.h
+@@ -34,7 +34,7 @@ extern struct pool_head *pool_head_pendconn;
+ 
+ struct pendconn *pendconn_add(struct stream *strm);
+ int pendconn_dequeue(struct stream *strm);
+-void process_srv_queue(struct server *s);
+int process_srv_queue(struct server *s);
+ unsigned int srv_dynamic_maxconn(const struct server *s);
+ int pendconn_redistribute(struct server *s);
+ int pendconn_grab_from_px(struct server *s);
+diff --git a/src/queue.c b/src/queue.c
+index 7555e2d..b93edf2 100644
+--- a/src/queue.c
+++ b/src/queue.c
+@@ -354,7 +354,7 @@ static int pendconn_process_next_strm(struct server *srv, struct proxy *px, int
+ /* Manages a server's connection queue. This function will try to dequeue as
+  * many pending streams as possible, and wake them up.
+  */
+-void process_srv_queue(struct server *s)
+int process_srv_queue(struct server *s)
+ {
+ 	struct server *ref = s->track ? s->track : s;
+ 	struct proxy  *p = s->proxy;
+@@ -413,6 +413,7 @@ void process_srv_queue(struct server *s)
+ 		if (p->lbprm.server_take_conn)
+ 			p->lbprm.server_take_conn(s);
+ 	}
+	return done;
+ }
+ 
+ /* Adds the stream <strm> to the pending connection queue of server <strm>->srv
+diff --git a/src/server.c b/src/server.c
+index 512fecd..cc2311a 100644
+--- a/src/server.c
+++ b/src/server.c
+@@ -6012,7 +6012,7 @@ static int _srv_update_status_op(struct server *s, enum srv_op_st_chg_cause caus
+ 		/* check if we can handle some connections queued.
+ 		 * We will take as many as we can handle.
+ 		 */
+-		process_srv_queue(s);
+		xferred = process_srv_queue(s);
+ 
+ 		tmptrash = alloc_trash_chunk();
+ 		if (tmptrash) {
+@@ -6198,7 +6198,7 @@ static int _srv_update_status_adm(struct server *s, enum srv_adm_st_chg_cause ca
+ 		/* check if we can handle some connections queued.
+ 		 * We will take as many as we can handle.
+ 		 */
+-		process_srv_queue(s);
+		xferred = process_srv_queue(s);
+ 	}
+ 	else if (s->next_admin & SRV_ADMF_MAINT) {
+ 		/* remaining in maintenance mode, let's inform precisely about the
+-- 
+1.7.10.4
+
--- a/backport-BUG-MEDIUM-queues-Do-not-use-pendconn_grab_from_px.patch
+++ b/backport-BUG-MEDIUM-queues-Do-not-use-pendconn_grab_from_px.patch
@ -0,0 +1,89 @@
+From e87aeeccfce15b27fb349c4a1f966c678d246417 Mon Sep 17 00:00:00 2001
+From: Olivier Houchard <ohouchard@haproxy.com>
+Date: Tue, 17 Dec 2024 15:39:21 +0100
+Subject: [PATCH] BUG/MEDIUM: queues: Do not use pendconn_grab_from_px().
+
+pendconn_grab_from_px() was called when a server was brought back up, to
+get some streams waiting in the proxy's queue and get them to run on the
+newly available server. It is very similar to process_srv_queue(),
+except it only goes through the proxy's queue, which can be a problem,
+because there is a small race condition that could lead us to add more
+streams to the server queue just as it's going down. If that happens,
+the server would just be ignored when back up by new streams, as its
+queue is not empty, and it would never try to process its queue.
+The other problem with pendconn_grab_from_px() is that it is very
+liberal with how it dequeues streams, and it is not very good at
+enforcing maxconn, it could lead to having 3*maxconn connections.
+For both those reasons, just get rid of pendconn_grab_from_px(), and
+just use process_srv_queue().
+Both problems are easy to reproduce, especially on a 64 threads machine,
+set a maxconn to 100, inject in H2 with 1000 concurrent connections
+containing up to 100 streams each, and after a few seconds/minutes the
+max number of concurrent output streams will be much higher than
+maxconn, and eventually the server will stop processing connections.
+
+It may be related to github issue #2744. Note that it doesn't totally
+fix the problem, we can occasionally see a few more connections than
+maxconn, but the max that have been observed is 4 more connections, we
+no longer get multiple times maxconn.
+
+have more outgoing connections than maxconn,
+This should be backported up to 2.6.
+
+(cherry picked from commit 111ea83ed4e13ac3ab028ed5e95201a1b4aa82b8)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+(cherry picked from commit ab4ff1b7a6c7685f28fbdea01b38caf7e816fddf)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+(cherry picked from commit b495692898072d6a843d36d4e66aae42e88a7c95)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+
+Conflict:NA
+Reference:https://git.haproxy.org/?p=haproxy-2.9.git;a=patch;h=e87aeeccfce15b27fb349c4a1f966c678d246417
+---
+ src/server.c |   14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/src/server.c b/src/server.c
+index 311b495..512fecd 100644
+--- a/src/server.c
+++ b/src/server.c
+@@ -5305,7 +5305,7 @@ static struct task *server_warmup(struct task *t, void *context, unsigned int st
+ 	server_recalc_eweight(s, 1);
+ 
+ 	/* probably that we can refill this server with a bit more connections */
+-	pendconn_grab_from_px(s);
+	process_srv_queue(s);
+ 
+ 	HA_SPIN_UNLOCK(SERVER_LOCK, &s->lock);
+ 
+@@ -6009,10 +6009,10 @@ static int _srv_update_status_op(struct server *s, enum srv_op_st_chg_cause caus
+ 		    !(s->flags & SRV_F_BACKUP) && s->next_eweight)
+ 			srv_shutdown_backup_streams(s->proxy, SF_ERR_UP);
+ 
+-		/* check if we can handle some connections queued at the proxy. We
+-		 * will take as many as we can handle.
+		/* check if we can handle some connections queued.
+		 * We will take as many as we can handle.
+ 		 */
+-		xferred = pendconn_grab_from_px(s);
+		process_srv_queue(s);
+ 
+ 		tmptrash = alloc_trash_chunk();
+ 		if (tmptrash) {
+@@ -6195,10 +6195,10 @@ static int _srv_update_status_adm(struct server *s, enum srv_adm_st_chg_cause ca
+ 		    !(s->flags & SRV_F_BACKUP) && s->next_eweight)
+ 			srv_shutdown_backup_streams(s->proxy, SF_ERR_UP);
+ 
+-		/* check if we can handle some connections queued at the proxy. We
+-		 * will take as many as we can handle.
+		/* check if we can handle some connections queued.
+		 * We will take as many as we can handle.
+ 		 */
+-		xferred = pendconn_grab_from_px(s);
+		process_srv_queue(s);
+ 	}
+ 	else if (s->next_admin & SRV_ADMF_MAINT) {
+ 		/* remaining in maintenance mode, let's inform precisely about the
+-- 
+1.7.10.4
+
--- a/backport-BUG-MEDIUM-queues-Make-sure-we-call-process_srv_queu.patch
+++ b/backport-BUG-MEDIUM-queues-Make-sure-we-call-process_srv_queu.patch
@ -0,0 +1,50 @@
+From f0c756518e9bfabfb317d22aa3416bc84eb543ba Mon Sep 17 00:00:00 2001
+From: Olivier Houchard <ohouchard@haproxy.com>
+Date: Fri, 13 Dec 2024 17:11:05 +0000
+Subject: [PATCH] BUG/MEDIUM: queues: Make sure we call process_srv_queue()
+ when leaving
+
+In stream_free(), make sure we call process_srv_queue() each time we
+call sess_change_server(), otherwise a server may end up not dequeuing
+any stream when it could do so. In some extreme cases it could lead to
+an infinite loop, as the server would appear to be available, as its
+"served" parameter would be < maxconn, but would end up not being used,
+as there are elements still in its queue.
+
+This should be backported up to 2.6.
+
+(cherry picked from commit dc9ce9c26469e00ab71fe6387dbd13010d4930f0)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+(cherry picked from commit 1385e4ca16b3797b0091a959b626935cd7f29b38)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+(cherry picked from commit 2de073ef00ee7d87aa82064dd2977645ec694730)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+
+Conflict:NA
+Reference:https://git.haproxy.org/?p=haproxy-2.9.git;a=patch;h=f0c756518e9bfabfb317d22aa3416bc84eb543ba
+---
+ src/stream.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/stream.c b/src/stream.c
+index f4a3298..c42cf95 100644
+--- a/src/stream.c
+++ b/src/stream.c
+@@ -625,11 +625,14 @@ void stream_free(struct stream *s)
+ 	}
+ 
+ 	if (unlikely(s->srv_conn)) {
+		struct server *oldsrv = s->srv_conn;
+ 		/* the stream still has a reserved slot on a server, but
+ 		 * it should normally be only the same as the one above,
+ 		 * so this should not happen in fact.
+ 		 */
+ 		sess_change_server(s, NULL);
+		if (may_dequeue_tasks(oldsrv, s->be))
+			process_srv_queue(oldsrv);
+ 	}
+ 
+ 	/* We may still be present in the buffer wait queue */
+-- 
+1.7.10.4
+
--- a/backport-BUG-MEDIUM-stream-Prevent-mux-upgrades-if-client-con.patch
+++ b/backport-BUG-MEDIUM-stream-Prevent-mux-upgrades-if-client-con.patch
@ -0,0 +1,47 @@
+From 56fb102c0c6094792fd38455b38b88a94454e996 Mon Sep 17 00:00:00 2001
+From: Christopher Faulet <cfaulet@haproxy.com>
+Date: Wed, 28 Aug 2024 15:42:22 +0200
+Subject: [PATCH] BUG/MEDIUM: stream: Prevent mux upgrades if client connection
+ is no longer ready
+
+If an early error occurred on the client connection, we must prevent any
+multiplexer upgrades. Indeed, it is unexpected for a mux to be initialized
+with no xprt. On a normal workflow it is impossible. So it is not an
+issue. But if a mux upgrade is performed at the stream level, an early error
+on the connection may have already been handled by the previous mux and the
+connection may be already fully closed. If the mux upgrade is still
+performed, a crash can be experienced.
+
+It is possible to have a crash with an implicit TCP>HTTP upgrade if there is no
+data in the input buffer. But it is also possible to get a crash with an
+explicit "switch-mode http" rule.
+
+It must be backported to all stable versions. In 2.2, the patch must be
+applied directly in stream_set_backend() function.
+
+(cherry picked from commit e4812404c541018ba521abf6573be92553ba7c53)
+Signed-off-by: Willy Tarreau <w@1wt.eu>
+(cherry picked from commit 13437097c312e524a346b9016d8ab273374d2053)
+Signed-off-by: Christopher Faulet <cfaulet@haproxy.com>
+
+Conflict: NA
+Reference: https://github.com/haproxy/haproxy/commit/56fb102c0c6094792fd38455b38b88a94454e996
+---
+ src/stream.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/stream.c b/src/stream.c
+index e643a6db6a05..89b7c238fe48 100644
+--- a/src/stream.c
+++ b/src/stream.c
+@@ -1488,6 +1488,10 @@ int stream_set_http_mode(struct stream *s, const struct mux_proto_list *mux_prot
+ 		return 0;
+ 
+ 	conn = sc_conn(sc);
+
+	if (!sc_conn_ready(sc))
+		return 0;
+
+ 	if (conn) {
+ 		se_have_more_data(s->scf->sedesc);
+ 		/* Make sure we're unsubscribed, the the new
--- a/backport-CVE-2025-32464.patch
+++ b/backport-CVE-2025-32464.patch
@ -0,0 +1,56 @@
+From 3e3b9eebf871510aee36c3a3336faac2f38c9559 Mon Sep 17 00:00:00 2001
+From: Willy Tarreau <w@1wt.eu>
+Date: Mon, 7 Apr 2025 15:30:43 +0200
+Subject: [PATCH] BUG/MEDIUM: sample: fix risk of overflow when replacing
+ multiple regex back-refs
+
+Aleandro Prudenzano of Doyensec and Edoardo Geraci of Codean Labs
+reported a bug in sample_conv_regsub(), which can cause replacements
+of multiple back-references to overflow the temporary trash buffer.
+
+The problem happens when doing "regsub(match,replacement,g)": we're
+replacing every occurrence of "match" with "replacement" in the input
+sample, which requires a length check. For this, a max is applied, so
+that a replacement may not use more than the remaining length in the
+buffer. However, the length check is made on the replaced pattern and
+not on the temporary buffer used to carry the new string. This results
+in the remaining size to be usable for each input match, which can go
+beyond the temporary buffer size if more than one occurrence has to be
+replaced with something that's larger than the remaining room.
+
+The fix proposed by Aleandro and Edoardo is the correct one (check on
+"trash" not "output"), and is the one implemented in this patch.
+
+While it is very unlikely that a config will replace multiple short
+patterns each with a larger one in a request, this possibility cannot
+be entirely ruled out (e.g. mask a known, short IP address using
+"XXX.XXX.XXX.XXX").  However when this happens, the replacement pattern
+will be static, and not be user-controlled, which is why this patch is
+marked as medium.
+
+The bug was introduced in 2.2 with commit 07e1e3c93e ("MINOR: sample:
+regsub now supports backreferences"), so it must be backported to all
+versions.
+
+Special thanks go to Aleandro and Edoardo for reporting this bug with
+a simple reproducer and a fix.
+
+Conflict: NA
+Reference: https://github.com/haproxy/haproxy/commit/3e3b9eebf871510aee36c3a3336faac2f38c9559
+---
+ src/sample.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/sample.c b/src/sample.c
+index 1e2ff7d2ee8e8..980c27cb6a507 100644
+--- a/src/sample.c
+++ b/src/sample.c
+@@ -3168,7 +3168,7 @@ static int sample_conv_regsub(const struct arg *arg_p, struct sample *smp, void
+ 		output->data = exp_replace(output->area, output->size, start, arg_p[1].data.str.area, pmatch);
+ 
+ 		/* replace the matching part */
+-		max = output->size - output->data;
+		max = trash->size - trash->data;
+ 		if (max) {
+ 			if (max > output->data)
+ 				max = output->data;
--- a/haproxy.spec
+++ b/haproxy.spec
@ -5,7 +5,7 @@

 Name:             haproxy
 Version:          2.9.5
-Release:          4
+Release:          9
 Summary:          The Reliable, High Performance TCP/HTTP Load Balancer

 License:          GPLv2+
@ -18,6 +18,14 @@ Source4:          %{name}.sysconfig

 Patch1:           backport-BUG-MINOR-server-source-interface-ignored-from-defau.patch
 Patch2:           Backport-CVE-2024-45506-BUG-MAJOR-mux-h2-always.patch
+Patch3:           CVE-2024-49214.patch
+Patch4:           backport-BUG-MEDIUM-stream-Prevent-mux-upgrades-if-client-con.patch
+Patch5:           CVE-2024-53008-1.patch
+Patch6:           CVE-2024-53008-2.patch
+Patch7:           backport-BUG-MEDIUM-queues-Do-not-use-pendconn_grab_from_px.patch
+Patch8:           backport-BUG-MEDIUM-queues-Make-sure-we-call-process_srv_queu.patch
+Patch9:           backport-BUG-MEDIUM-queue-Make-process_srv_queue-return-the-n.patch
+Patch10:          backport-CVE-2025-32464.patch

 BuildRequires:    gcc lua-devel pcre2-devel openssl-devel systemd-devel systemd libatomic
 Requires(pre):    shadow-utils
@ -122,6 +130,32 @@ exit 0
 %{_mandir}/man1/*

 %changelog
+* Tue Apr 29 2025 xinghe <xinghe2@h-partners.com> - 2.9.5-9
+- Type:cves
+- CVE:CVE-2025-32464
+- SUG:NA
+- DESC:fix CVE-2025-32464
+
+* Mon Mar 17 2025 yanglu <yanglu72@h-partners.com> - 2.9.5-8
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:queues:Do not use pendconn_grab_from_px
+       queues:Make sure we call process_srv_queue when leaving
+       queue:Make process_srv_queue return the number of streams
+
+* Tue Dec 10 2024 wangkai <13474090681@163.com> - 2.9.5-7
+- Fix CVE-2024-53008
+
+* Thu Nov 21 2024 xinghe <xinghe2@h-partners.com> - 2.9.5-6
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:stream: Prevent mux upgrades if client connection is no longer ready
+
+* Mon Oct 14 2024 yaoxin <yao_xin001@hoperun.com> - 2.9.5-5
+- Fix CVE-2024-49214
+
 * Wed Sep 04 2024 yinyongkang <yinyongkang@kylinos.cn> - 2.9.5-4
 - Type:CVE
 - CVE:CVE-2024-45506
Author	SHA1	Message	Date
openeuler-ci-bot	d6dca68099	!171 fix CVE-2025-32464 From: @xinghe_1 Reviewed-by: @jiangheng12 Signed-off-by: @jiangheng12	2025-04-29 07:48:27 +00:00
xh	3d1a3148ca	fix CVE-2025-32464	2025-04-29 14:59:21 +08:00
openeuler-ci-bot	d5d68cf310	!161 sync some pathes from upstream From: @yangl777 Reviewed-by: @robertxw Signed-off-by: @robertxw	2025-03-20 03:53:06 +00:00
yangl777	25cd8bcf22	sync some pathes from upstream	2025-03-17 10:42:32 +00:00
openeuler-ci-bot	a384b803bc	!155 [sync] PR-152: Fix CVE-2024-53008 From: @openeuler-sync-bot Reviewed-by: @wang--ge Signed-off-by: @wang--ge	2024-12-10 07:13:07 +00:00
wk333	11d681b403	Fix CVE-2024-53008 (cherry picked from commit e053271e1181ee3ddd317185751d515fada3a626)	2024-12-10 14:18:36 +08:00
openeuler-ci-bot	a77f1e6fd2	!148 backport upstream patches From: @xinghe_1 Reviewed-by: @wang--ge Signed-off-by: @wang--ge	2024-11-21 07:51:19 +00:00
xh	5c2977b534	backport upstream patches	2024-11-21 03:34:42 +00:00
openeuler-ci-bot	4a562f7c34	!142 Fix CVE-2024-49214 From: @starlet-dx Reviewed-by: @wang--ge Signed-off-by: @wang--ge	2024-10-14 08:29:13 +00:00
starlet-dx	aec3b76ff8	Fix CVE-2024-49214	2024-10-14 15:39:51 +08:00