From: William Lallemand <wlallemand@haproxy.com>
Date: Thu, 6 Aug 2026 07:29:07 +0000 (+0200)
Subject: BUG/MEDIUM: acme: don't delete a NULL token from the map
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b5e77960c42864c98548cb4a882720b625bcf727;p=thirdparty%2Fhaproxy.git

BUG/MEDIUM: acme: don't delete a NULL token from the map

When an ACME task ends, acme_del_acme_ctx_map() walks the list of
authorizations and removes each challenge token from the configured map.
But an authorization is created with only its URL set, and its token is
only filled in once the CA's answer for that authorization has been
successfully parsed. The "dns-persist-01" challenge type never sets one at
all. Every termination path of the task goes through that cleanup, so a
NULL token was passed to pat_ref_delete(), which compares it against the
keys of the reference and dereferences it.

For users this means that an ACME configuration using a "map" crashes the
worker whenever the certificate renewal fails early, for instance when the
CA is unreachable and the retries are exhausted, or when it answers
something unexpected. The very component that is supposed to keep the
service running then takes it down.

Let's simply ignore authorizations without a token, they have nothing
registered in the map anyway.

This was introduced in 3.2 by commit 5555926fd ("MEDIUM: acme: use a map
to store tokens and thumbprints"). It must be backported to 3.2.

Reported-by: Claude (ANT-2026-YXC5HJZS)
---

diff --git a/src/acme.c b/src/acme.c
index 6d07eb744..367fa12b1 100644
--- a/src/acme.c
+++ b/src/acme.c
@@ -1272,8 +1272,8 @@ static void acme_del_challenge_map(const char *map, const char *challenge)
 {
 	struct pat_ref *ref;
 
-	/* when no map configured, return without error */
-	if (!map)
+	/* no map configured, or no challenge token was retrieved */
+	if (!map || !challenge)
 		return;
 
 	ref = pat_ref_lookup(map);