Detections
Analytics

openSUSE 16 Security Update : haproxy (openSUSE-SU-2026:22162-1)

medium Nessus Plugin ID 371820

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22162-1 advisory.

 This update for haproxy fixes the following issue:

 - h1-htx: report an error on a too long chunk-size line (bsc#1285046).

 Changes for haproxy:

 - Otel Update to version 2.3.0+git2.b031728:
 * DOC: otel: added a security policy to the repository
 * MINOR: otel: test: added a test with an optional upstream context
 * VERSION: otel: bumped filter version to 2.3.0
 * DOC: otel: shortened the repeated passages of the implementation guide
 * BUG/MINOR: otel: left a baggage pair out when its sample yielded nothing
 * DOC: otel: completed the stream stop notes and the function reference
 * DOC: otel: added the load-time warnings and missing rules to the guides
 * DOC: otel: corrected stale statements across the guides and notes
 * DOC: otel: corrected and completed the keyword guides
 * CLEANUP: otel: marked the code that cannot run with a NOTE comment
 * CLEANUP: otel: described the invalid-character check modes
 * MINOR: otel: checked the context field key against the W3C rules
 * DOC: otel: added an overview of the tests
 * MINOR: otel: reported the event pairings on the line that completes them
 * MINOR: otel: warned about an otel-scope that never runs
 * MINOR: otel: enforced the root span rules
 * MINOR: otel: validated the span and context names of every reference
 * MINOR: otel: enforced the rules of the inject and extract context names
 * MINOR: otel: bound the instrument lines of one name to a single owner
 * MINOR: otel: let a key repeat once per condition, first match applied
 * MINOR: otel: gave the 'link' keyword a condition and let it repeat
 * MINOR: otel: allowed the 'otel-stop' keyword to be repeated
 * MINOR: otel: ended a sample list at a repeated clause of the same line
 * MINOR: otel: separated a repeated span line from a redefinition
 * MINOR: otel: checked the metric instrument line against the SDK rules
 * MINOR: otel: allowed each otel-instrumentation keyword only once
 * MINOR: otel: required the configuration to live inside an OTel scope
 * MINOR: otel: allowed the configuration sections in any order
 * MINOR: otel: rejected a bare 'if' or 'unless' with no ACL term
 * MINOR: otel: made an ACL name unique within its section
 * BUG/MINOR: otel: allowed a condition to mix ACLs from the three lists
 * MINOR: otel: refused the reserved words as names and limited the length
 * MINOR: otel: named the sample key where the value stands on its own
 * BUG/MINOR: otel: read the whole filter line before its configuration
 * BUG/MINOR: otel: allowed a repeated sample expression in one value
 * BUG/MINOR: otel: stopped measuring a sample expression as a name
 * BUG/MINOR: otel: named the 'config' keyword in its own parse error
 * CLEANUP: otel: compared the baggage carrier key without case folding
 * CLEANUP: otel: replaced the word 'verbatim' in the comments and guides
 * CLEANUP: otel: added the entry traces to the functions that lacked them
 * CLEANUP: otel: collected the repeated error messages into macros
 * MINOR: otel: test: added the configuration parser test
 * DOC: otel: added the keyword definition rules and updated the guides
 * CLEANUP: otel: replaced the word 'gate' in the comments and guides
 * MINOR: otel: warned about the events the filter placement never fires
 * BUG/MINOR: otel: kept a backend filter from re-running the frontend rules
 * BUG/MINOR: otel: fired on-server-unavailable when no server was reached
 * BUG/MINOR: otel: armed the idle timer for a filter of a backend section
 * MINOR: otel: required every otel-group to be named on a 'groups' line
 * BUG/MINOR: otel: cleared the section state after an aborted parse
 * BUG/MINOR: otel: gave the events that run on no channel a usable direction
 * CLEANUP: otel: used the span event dump macro where the events are handled
 * MINOR: otel: checked 'extract use-headers' against the scope event
 * BUG/MINOR: otel: kept the session alive when a root scope is skipped
 * CLEANUP: otel: collected the session disabling into one function
 * LICENSE: otel: added the LICENSE file and moved the headers to the GPL
 * MINOR: otel: added a sampler level to the speed test
 * MINOR: otel: evaluated the samples in a trash buffer
 * MEDIUM: otel: skipped the samples of a span that records nothing
 - Update to version 3.4.7+git0.8872a2604:
 * [RELEASE] Released version 3.4.7
 * BUG/MAJOR: h1-htx: report an error on a too long chunk-size line (bsc#1285046)
 * BUG/MAJOR: mux-h2: properly handle short reads on PING frames
 * BUG/MINOR: cfgparse-global: only warn when localpeer is set together with -L
 * REGTEST: ssl: require OpenSSL 1.1.1 for crt-list ciphersuites tests
 * REGTESTS: http-messaging: Fix http_fail_cnt_body to succeed with small timeouts
 * BUG/MEDIUM: mux-h1: only accept the H2 preface on the first request
 * BUG/MINOR: http-fetch: don't report pseudo-headers in TCP mode
 * BUG/MEDIUM: mux-h1: also release the embryonic stream when the error is empty
 * BUG/MEDIUM: mux-h2: fix a possible crash on rxbuf allocation failure
 * BUG/MEDIUM: mux-h2: report a dead rhttp connection in h2_wake()
 * BUG/MEDIUM: mux-h1: don't pass an upgraded connection to traces in h1s_destroy()
 * BUG/MEDIUM: mux-fcgi: don't return a freed tasklet from fcgi_deferred_shut()
 * BUG/MEDIUM: mux-h2: don't return a freed tasklet from h2_deferred_shut()
 * BUG/MINOR: hlua: assume proxy_find_by_id() may return NULL on previously existing server
 * BUG/MINOR: spoe: Fix the message list splice with an empty list
 * REGTESTS: log: check that a log-forward TCP session ends on client close
 * BUG/MEDIUM: log: do not ignore the peer's shutdown in the syslog applet
 * REGTESTS: cli: test a command line of exactly tune.bufsize bytes
 * BUG/MEDIUM: cli: fix the last command detection on a full command line
 * BUG/MINOR: cfgparse-listen: complete the list of options for the suggestions
 * BUG/MINOR: proxy: also look for the closest option among cfg_opts3
 * BUG/MINOR: cfgparse-listen: properly reject extra args in a backend section
 * BUG/MINOR: cfgparse-listen: fix quoting of the condition conflict warning
 * BUG/MINOR: cfgparse-listen: fix the argument checked by email-alert
 * BUG/MINOR: cfgparse-listen: release the previous description of the proxy
 * BUG/MINOR: cfgparse-global: add missing calloc() check for the global description
 * BUG/MINOR: cfgparse-global: add missing gotos to error label in max-spread-checks
 * BUG/MAJOR: cfgparse: properly check userlist section when scanning keywords
 * MINOR: doc: elaborate on diagnostic mode behavior
 * BUG/MINOR: ssl: Fix potential NULL-deref in dump ssl cert with AWS-LC
 * BUG/MINOR: h3: reject RS/SS for QPACK uni streams
 * BUG/MINOR: h3: close connection on GOAWAY frame too long
 * BUG/MINOR: h3: reject frames with truncated header
 * BUG/MINOR: mux_quic: extend FINAL_SIZE_ERROR detection on stream
 * BUG/MINOR: ssl: use standard names for X25519 and X448 groups
 * BUG/MEDIUM: listener: Consider maxconn before waking listeners
 * BUG/MEDIUM: ssl: crt-list curves ignored with AWS-LC
 * BUG/MEDIUM: ssl: crt-list ciphers ignored with AWS-LC
 * BUG/MINOR: ssl: fix trace crash on BE conn release in io cb
 * BUG/MINOR: ssl: fix trace crash on FE conn release in io cb
 * BUG/MINOR: hq-interop: prevent double EOM on request with standalone FIN
 * BUG/MINOR: log: fix erroneous error message in log-steps parser
 * MINOR: http-ana: automatically enable http-no-delay for streaming events (SSE)
 * BUG/MINOR: cli: update wait help usage
 * BUG/MINOR: server: fix del server description
 * BUG/MINOR: proxy: add PR_CAP_LB for dynamically added backend
 * DOC: config: mention that url_ip and url_port fail when passed a name
 * DOC: config: fix doc for hex2i() converter on unparsable input
 * DOC: config: mention other responses not blocked by option checkcache
 * BUG/MINOR: sample: return the decoded JWT part when no path is given
 * BUG/MEDIUM: tcpcheck: do not run a regex on an unallocated buffer
 * BUG/MINOR: http-fetch: do not count Set-Cookie attributes as cookies
 * BUG/MINOR: payload: always report a boolean from req.ssl_ec_ext
 * BUG/MINOR: stick-table: do not count the lookup itself in table_trackers()
 * BUG/MINOR: http-ana: return a 502 when checkcache blocks a response
 * BUG/MINOR: sample: make quic_enabled() always succeed
 * BUG/MINOR: sample: zero-pad the fractional part emitted by http_date()
 * BUG/MINOR: sample: apply the ms_/us_ time offsets in the input unit
 * BUG/MINOR: http: do not consume the delimiter of a truncated q-factor
 * BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5)
 * BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5
 * BUG/MEDIUM: pattern: don't dereference static_pattern's data when not filling it
 * BUG/MEDIUM: stick-table: restrict key sizes to what fits in a buffer
 * MINOR: stick-table: calculate the on-wire size of each key
 * MINOR: stick-table: provide a function to estimate on-wire data size
 * BUILD: haring: fix compile issue due to nop warning.
 * MINOR: stconn: prefer to replace endpoints rather than detaching them
 * BUG/MINOR: flt-http-comp: Rely on htx_set_eom() to restore EOM flag
 * BUG/MEDIUM: flt-http-comp: Block HTX_FL_EOM flag till the end of compression
 * MINOR: quic: implement the AEAD integrity limit
 * MEDIUM: jwt: Reject none alg in jwt_verify by default
 * [RELEASE] Released version 3.4.6
 * REGTESTS: log: check that a ring's internal server may target a UNIX socket
 * BUG/MEDIUM: server: skip log backend addr checks for internal proxies
 * BUG/MEDIUM: sink: reconnect attempt not working after session lasted more than ~25 days
 * BUG/MAJOR: mux_quic: fix potential crash on RESET_STREAM receive
 * MINOR: log: add the +utf8 encoding option to let valid UTF-8 pass
 * MINOR: log: pass the input end to the _lf_encode_bytes() byte encoders
 * [RELEASE] Released version 3.4.5
 * BUG/MINOR: mux-h2: Reject trailers received on a tunneled stream
 * REGTESTS: log: check the escaping performed by the +json option
 * BUG/MEDIUM: log: encode the whole non-printable range in the +json output
 * BUG/MEDIUM: mux_quic: activate timeout on FE init
 * BUG/MAJOR: mux_quic: fix leak on RESET_STREAM reception
 * BUG/MINOR: http-ana: restore the transaction status after early hints
 * BUG/MINOR: tcpcheck: refresh the start-line after updating the authority
 * BUG/MINOR: mux-h1: only mark C-L and T-E as sent once the header is emitted
 * BUG/MINOR: http-fetch: fix the space check of http_auth_bearer(<hdr>)
 * BUG/MINOR: http-fetch: http_auth_bearer() must not match a missing header
 * BUG/MINOR: http-ana: count response body failures only once in http_fail_cnt
 * BUG/MEDIUM: tcp-rules: ignore capture len rules evaluated from a backend
 * BUG/MEDIUM: http-act: ignore capture len rules evaluated from a backend
 * BUG/MEDIUM: http-htx: don't build the new authority in a rotating trash chunk
 * BUG/MEDIUM: log: reserve the trailing 0 in CBOR int and bool encoders
 * REG-TESTS: http-messaging: Add a script to test interim responses for H1/H2
 * BUG/MINOR: mux-h2: Don't expect more HTX data on 1xx interim responses
 * BUG/MINOR: http-client: Convert server timeout ticks when setting it
 * BUG/MINOR: ssl: Fix possible null deref on the SSL context in ssl_sock_to_buf()
 * BUG/MINOR: hlua: release private Lua rule data on teardown
 * BUG/MAJOR: htx: Check the header/trailer length limits when one is updated
 * BUG/MINOR: tools: Don't try to anonymize a NULL string
 * BUG/MEDIUM: htx: Fix the position returned by htx_defrag()
 * BUG/MEDIUM: http-client/cli: Notify the http-client when the response is consumed
 * MINOR: http-client: Add a function to notify some data were consumed
 * BUG/MEDIUM: acme: Set HTTPCLIENT_O_RES_ACCUM option on the http-client
 * BUG/MEDIUM: ssl/ocsp: Set HTTPCLIENT_O_RES_ACCUM option on the http-client
 * MINOR: http-client: Add an option to not stop the reception of the response
 * BUG/MEDIUM: http-client: Don't use the httpclient context if it was released
 * BUG/MEDIUM: task: Do not destroy a task that is not ours in task_destroy
 * OPTIM: tools: keep a cache of recent localtime() and gmtime()
 * MAJOR: filters: Revert the filter-sequence directive
 * BUG/MINOR: proxy: pass PR_FL_DEF_EXPLICIT_MODE through cascaded defaults
 * BUG/MEDIUM: tcp-rules: Don't restart tcp-request content evaluation on yield
 * CLEANUP: stream: Remove an excess newline in the stream dump
 * BUG/MEDIUM: htx: Reserve a block descriptor for zero-sized blocks
 * BUG/MEDIUM: ssl: don't set a 0 timeout on an expired TLS session
 * DOC: configuration: clarify the validity ranges of sample types
 * REGTESTS: http-rules: check -m str on a sample with an embedded \0
 * BUG/MINOR: sample: reject a \0 byte in url_dec, json_query and jwt_*_query
 * BUG/MINOR: ssl: Fix leak of ca_list in cafile_entry
 * BUG/MINOR: cli: Reject payload with no command
 * BUG/MEDIUM: cli: Don't read a command or payload line into a full buffer
 * BUG/MEDIUM: cli: Don't parse next command if input buffer is empty
 * BUG/MEDIUM: http_act: fix normalize-uri normalizer selection with a condition
 * REGTESTS: map: check map_regm inside an ACL over an iterating fetch
 * BUG/MEDIUM: map: do not overwrite the fetch context in pat_match_regm()
 * BUG/MINOR: ssl: don't pass the address of a size_t as an int* to OpenSSL
 * BUG/MEDIUM: http-ana: apply tunnel timeout with data filters
 * BUG/MINOR: h3: only increment frame type counter on new header
 * BUG/MINOR: h3: handle unknown frame type on request stream as specified
 * BUG/MINOR: h3: handle empty HEADERS frame as specified
 * BUG/MEDIUM: h3: do not block FIN on empty DATA frame
 * BUG/MINOR: h3: reject truncated frames with mandatory payload
 * BUG/MINOR: stream/debug: harden the stream dump function regarding signals
 * BUG/MEDIUM: htx: Don't reset flags when source must be preserved during transfer
 * BUG/MINOR: hlua: Always return nil if there is no data to dup for HTTP messages
 * BUG/MINOR: mux-h1: Return an error on trailers if last chunk is unfinished
 * BUG/MEDIUM: hlua: Never release a cosocket applet from the GC
 * DOC: config: clarify tune tune.bufsize doc regarding various limits
 * BUG/MINOR: quic: leak of the NEW_TOKEN frame on token generation failure
 * BUG/MAJOR: h3: reject H3 truncated frames
 * BUG/MEDIUM: mux-h2: Make sure we remove H2_SF_NOTIFIED on subscribe
 * MEDIUM: mux-h1: Harden test for short data at end of stream
 * REGTESTS: log: check that the +cbor output passes the logged bytes through
 * DOC: config: mention that section 8.6 does not apply to the cbor encoding
 * REGTESTS: log: check which log-format tags escape control characters
 * REGTESTS: log: add a test for show events -s
 * MINOR: ring: add -s flag to show events to sanitize the output
 * BUG/MINOR: quic: delete the wrong CIDs when post-handshake frames fail
 * BUG/MINOR: qpack: accept a Required Insert Count which cannot be reached
 * BUG/MINOR: qpack: encoder and decoder stream data is never consumed
 * MINOR: quic: protect the ChaCha20 header protection context from being freed
 * CLEANUP: resolvers: stop clearing the DNS response buffer
 * BUG/MINOR: resolvers: classify empty truncated responses
 * BUN/MINOR: hlua: reset hlua_body variable after per-thread files loading
 * BUG/MEDIUM: filters: check the filter name before comparing it
 * BUG/MINOR: quic: late packets of the first key phase are dropped
 * BUG/MEDIUM: quic: crash on key update phase change after a failed one
 * BUG/MINOR: payload: bound ClientHello extension lists by the extension length
 * BUG/MINOR: payload: fix the cipher_len bound check in smp_client_hello_parse()
 * BUG/MEDIUM: mux-spop: Properly handle parsing of split HELLO/DISCONNECT frames
 * OPTIM: server: remember the lowest known unused server ID
 * BUG/MINOR: cache: Seed cache primary hash
 * BUG/MINOR: cache: Manage collisions on primary key
 - Update to version 3.4.3+git88.24ec4c12d:
 * BUG/MEDIUM: sink: do not create one implicit ring per logger copy
 * BUG/MEDIUM: sink: initialize the settings of the implicit log server
 * BUG/MINOR: flt-http-comp: Don't read next block to detect end of data
 * BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters
 * BUG/MEDIUM: cache: ignore cache on redundant origin/referer
 * REGTESTS: converters: use connection: close in the has_ctl() test
 * MINOR: debug: check the match count in __BUG_ON_ONCE() and not in complain()
 * MINOR: sample: add new converter has_ctl() to detect control characters
 * DOC: haterm: add a missing 'haterm' build target on an example
 * BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages()
 * BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch
 * MEDIUM: mux-h2: don't report EOM on a short content-length message
 * BUG/MEDIUM: mux-h1: close the connection on a short content-length

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected haproxy package.

See Also

https://bugzilla.suse.com/1285046

Plugin Details

Severity: Medium

ID: 371820

File Name: openSUSE-2026-22162-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/25/2026

Updated: 10/25/2026

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:haproxy

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/23/2026

Vulnerability Publication Date: 10/23/2026