From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Wed, 26 Aug 2026 15:08:26 +0000 (+0200)
Subject: BUG/MINOR: cache: Seed cache primary hash
X-Git-Tag: v3.5-dev6~59
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=bb422f8e184e4671bda16c0e253fd310b686cfa8;p=haproxy.git

BUG/MINOR: cache: Seed cache primary hash

Since only the first 32bits of the primary hash built in sha1_hosturi
are used as key in the cache tree and we reject entries when a hash
collision happens, it would be possible for an attacher to fill a
specific cache entry with "wrong" data and prevent actual caching.
Since a cache seed was already built for secondary key hashes we might
as well use it for primary hashes as well.

Reported-by: Claude (ANT-2026-9WRFEVJ3)

This patch should be backported to all stable branches.
---

diff --git a/src/cache.c b/src/cache.c
index b3009d413..b1a9803d6 100644
--- a/src/cache.c
+++ b/src/cache.c
@@ -2434,6 +2434,7 @@ int sha1_hosturi(struct stream *s)
 
 	/* hash everything */
 	blk_SHA1_Init(&sha1_ctx);
+	blk_SHA1_Update(&sha1_ctx, &cache_hash_seed, sizeof(cache_hash_seed));
 	blk_SHA1_Update(&sha1_ctx, trash->area, trash->data);
 	blk_SHA1_Final((unsigned char *)txn->cache_hash, &sha1_ctx);