From 5dc325e5a8bc64c766ef68e4527c98bed1ea3203 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 15 Feb 2026 15:49:23 +0100 Subject: [PATCH] package/haproxy: security bump to v2.6.23 For more information on the release, see: - https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=c3bf1ac6709072bf9984c829c3badda5a4e8fa7e This fixes the following vulnerability: - CVE-2025-11230: Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2025-11230 - https://www.haproxy.com/blog/october-2025-cve-2025-11230-haproxy-mjson-library-denial-of-service-vulnerability Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit d94d4ff0a6e39f3ac024069134d0ab9209027686) Signed-off-by: Thomas Perale --- package/haproxy/haproxy.hash | 4 ++-- package/haproxy/haproxy.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/haproxy/haproxy.hash b/package/haproxy/haproxy.hash index 42f340fa80..ce5dae17e7 100644 --- a/package/haproxy/haproxy.hash +++ b/package/haproxy/haproxy.hash @@ -1,5 +1,5 @@ -# From: http://www.haproxy.org/download/2.6/src/haproxy-2.6.22.tar.gz.sha256 -sha256 4c0797f450f997dc287d2c7aafa7a0e5b7a2d71593a2cd58e664e8f3aea614fa haproxy-2.6.22.tar.gz +# From: http://www.haproxy.org/download/2.6/src/haproxy-2.6.23.tar.gz.sha256 +sha256 1281d57f25e98456a042c81f32801a106a293c1340b0c06debb2a87d6a7b3611 haproxy-2.6.23.tar.gz # Locally computed: sha256 0717ca51fceaa25ac9e5ccc62e0c727dcf27796057201fb5fded56a25ff6ca28 LICENSE sha256 5df07007198989c622f5d41de8d703e7bef3d0e79d62e24332ee739a452af62a doc/lgpl.txt diff --git a/package/haproxy/haproxy.mk b/package/haproxy/haproxy.mk index f60cb1e08a..51878e754f 100644 --- a/package/haproxy/haproxy.mk +++ b/package/haproxy/haproxy.mk @@ -5,7 +5,7 @@ ################################################################################ HAPROXY_VERSION_MAJOR = 2.6 -HAPROXY_VERSION = $(HAPROXY_VERSION_MAJOR).22 +HAPROXY_VERSION = $(HAPROXY_VERSION_MAJOR).23 HAPROXY_SITE = http://www.haproxy.org/download/$(HAPROXY_VERSION_MAJOR)/src HAPROXY_LICENSE = GPL-2.0+ and LGPL-2.1+ with exceptions HAPROXY_LICENSE_FILES = LICENSE doc/lgpl.txt doc/gpl.txt