From: Willy Tarreau Date: Thu, 13 Aug 2026 09:49:26 +0000 (+0200) Subject: DOC: security: clarify that only up-to-date versions may get securty reports X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=70b6c5826487118cd774e601aa6b6ed419e48762;p=thirdparty%2Fhaproxy.git DOC: security: clarify that only up-to-date versions may get securty reports With the increasing rate of low-effort, AI-driven security reports, we're seeing an increasing level of noise. Let's first clarify what's usually obvious to developers but not necessarily to bug reporters, which is that vulnerability reports must exclusively apply to latest version of a branch. The goal here is to reduce the amount of time wasted analyzing an issue to finally respond "already fixed 3 months ago". Let's also add the link to the bugs page to ease extra checks on the reporter's side when they cannot re-run the scan (which usually is the case when time slots are granted on software scanners and they're run against an outdated version). This must be backported where the security doc is already present. --- diff --git a/doc/security.txt b/doc/security.txt index bd218d9ec..01c146f75 100644 --- a/doc/security.txt +++ b/doc/security.txt @@ -1,6 +1,22 @@ Reporting security issues in HAProxy ------------------------------------ +Security issues may ONLY be reported against the LATEST released version of a +branch, as indicated on https://www.haproxy.org/. It is the reporter's sole +responsibility to verify that the issue exists in the upstream source code of +the latest release for a given branch before submitting a report. Reports are +frequently generated against older versions containing known, previously +resolved bugs. Triaging these duplicate claims severely drains maintainer +resources. If you are analyzing a specific version and cannot test the latest +release, you MUST review your version's bugs at https://www.haproxy.org/bugs/ +and check the repository history to verify whether the fixes missing from that +version address the issue. If the bug has already been resolved upstream, you +must update your version or identify the specific missing patch, and refrain +from sharing your report which then brings no value. + +Maintainers reserve the right to silently ignore security reports for issues +already resolved in up-to-date releases. + Before reporting anything, please read doc/internals/threat-model.txt. It defines precisely what is and is not considered a security vulnerability in HAProxy. A fair number of suspected issues (and most automated or LLM-assisted