From 03b503e252bcc09ba86bbb20e87f9751eac20dae Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Wed, 16 Sep 2026 09:17:29 +0200
Subject: [PATCH] haproxy: fix CVE-2026-90678

Apply the version-specific upstream HTTP/3 parser fix.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
Not-cherry-picked-because: HAProxy 3.3 requires its version-specific upstream backport
---
 pkgs/by-name/ha/haproxy/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix
index 338cb9e06897..aeba1f57889e 100644
--- a/pkgs/by-name/ha/haproxy/package.nix
+++ b/pkgs/by-name/ha/haproxy/package.nix
@@ -5,6 +5,7 @@
   sslLibrary ? "openssl",
   stdenv,
   lib,
+  fetchpatch,
   fetchurl,
   nixosTests,
   zlib,
@@ -40,6 +41,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ywGFCNBymseyaGlEqKk37a3bB0ThDNEFfdZQFQzcKD4=";
   };
 
+  patches = [
+    # Remove once the packaged release fixes CVE-2026-90678.
+    (fetchpatch {
+      name = "CVE-2026-90678.patch";
+      url = "https://github.com/haproxy/haproxy/commit/81482d95aa6dfbd3f6eadd2f3650f256dc0b4e03.patch";
+      hash = "sha256-jmupw5lPzWqutD4RpAECetFNLzXvejWS4PCoMW+ZPtM=";
+    })
+  ];
+
   buildInputs = [
     sslPkg
     zlib