Segfault shortly after start with a mode log backend server udp@... and check without port; haproxy -c accepts the configuration

The crash comes from a mode log backend whose server line uses udp@ with check and no port on the check, so start with the server-line and health-check parsing for the log-mode backend in the haproxy source. Reproduce with the crash.cfg configuration from the issue, run haproxy -f crash.cfg -db under gdb to get a backtrace, then find where the check port is resolved as null. Done means the process either refuses the config at parse time with a clear message or starts without segfaulting.

Detailed Description of the Problem

A mode log backend whose server is udp@

: with check (and no port on the check) passes haproxy -c, then the process crashes with SIGSEGV about two seconds after start. The timing did not change with inter 60s or with timeout connect 5s.

$ haproxy -c -f crash.cfg; echo $?
0
$ haproxy -f crash.cfg -db; echo $?
[NOTICE] (...) : Automatically setting global.maxconn to 262126.
Segmentation fault (core dumped)
139

The same configuration runs normally with check port 18515 instead of check, and without check. HAProxy printed nothing before the crash.

Expected Behavior

Either the check uses the server's port, or the configuration is refused at parse time (and by haproxy -c) with a message saying the check needs a port. A configuration that validates should not crash the process.

Steps to Reproduce the Behavior

1. Save the configuration below as crash.cfg.

2. haproxy -c -f crash.cfg - exits 0.

3. haproxy -f crash.cfg -db - segfaults after about two seconds (exit 139).

4. Change check to check port 18515 - the process runs.

Nothing needs to listen on either port.

Do you have any idea what may have caused this?

No.

Do you have an idea how to solve the issue?

No. We always write port on such checks now.

What is your configuration?

defaults
    timeout connect 2s
    timeout client 5s
    timeout server 5s

log-forward syslog-in
    dgram-bind 127.0.0.1:18514
    log backend@be-syslog local0

backend be-syslog
    mode log
    balance roundrobin
    server s1 [email protected]:18515 check

Output of haproxy -vv

HAProxy version 3.4.6-1ppa1~resolute 2026/09/30 - https://haproxy.org/
Status: long-term supported branch - will stop receiving fixes around Q2 2031.
Known bugs: http://www.haproxy.org/bugs/bugs-3.4.6.html
Running on: Linux 7.0.0-38-generic #38-Ubuntu SMP PREEMPT_DYNAMIC Fri Sep  4 09:10:14 UTC 2026 x86_64
Build options : 
  TARGET  = linux-glibc
  CC      = x86_64-linux-gnu-gcc
  CFLAGS  = -O2 -g -fwrapv -fvect-cost-model=very-cheap -g -O2 -Werror=implicit-function-declaration -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -flto=auto -ffat-lto-objects -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -fdebug-prefix-map=/build/haproxy-fMvzI9/haproxy-3.4.6=/usr/src/haproxy-3.4.6-1ppa1~resolute -Wdate-time -D_FORTIFY_SOURCE=3
  OPTIONS = USE_OPENSSL=1 USE_LUA=1 USE_SLZ=1 USE_OT=1 USE_QUIC=1 USE_PROMEX=1 USE_PCRE2=1 USE_PCRE2_JIT=1
  DEBUG   = 

Feature list : -51DEGREES +ACCEPT4 +ACME +BACKTRACE -CLOSEFROM +CPU_AFFINITY +CRYPT_H -DEVICEATLAS +DL -ECH -ENGINE +EPOLL -EVPORTS +GETADDRINFO +HAVE_TCP_MD5SIG -KQUEUE +KTLS -LIBATOMIC +LIBCRYPT +LINUX_CAP +LINUX_SPLICE +LINUX_TPROXY +LUA +MATH -MEMORY_PROFILING +NETFILTER +NS -OBSOLETE_LINKER +OPENSSL -OPENSSL_AWSLC -OPENSSL_WOLFSSL +OT -PCRE +PCRE2 +PCRE2_JIT -PCRE_JIT +POLL +PRCTL -PROCCTL +PROMEX -PTHREAD_EMULATION +QUIC -QUIC_OPENSSL_COMPAT +RT +SHM_OPEN +SLZ +SSL -STATIC_PCRE -STATIC_PCRE2 +TFO +THREAD +THREAD_DUMP +TPROXY +TRACE -WURFL -ZLIB
Detected feature list : +HAVE_WORKING_TCP_MD5SIG

Default settings :
  bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with multi-threading support (MAX_TGROUPS=32, MAX_THREADS=1024, default=8).
Built with SSL library version : OpenSSL 3.5.5 27 Jan 2026
Running on SSL library version : OpenSSL 3.5.5 27 Jan 2026
SSL library supports TLS extensions : yes
SSL library supports SNI : yes
SSL library default verify directory : /usr/lib/ssl/certs
SSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
OpenSSL providers loaded : default
QUIC: connection sock-per-conn mode support : yes
QUIC: GSO emission support : yes
Built with Lua version : Lua 5.4.8
Built with the Prometheus exporter as a service
Built with network namespace support.
Built with OpenTracing support.
Built with libslz for stateless compression.
Compression algorithms supported : identity("identity"), deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT IP_FREEBIND
Built with PCRE2 version : 10.46 2025-08-27
PCRE2 library supports JIT : yes
Encrypted password support via crypt(3): yes
Built with gcc compiler version 15.2.0

Available polling systems :
      epoll : pref=300,  test result OK
       poll : pref=200,  test result OK
     select : pref=150,  test result OK
Total: 3 (3 usable), will use epoll.

Available multiplexer protocols :
(protocols marked as <default> cannot be specified using 'proto' keyword)
       quic : mode=HTTP  side=FE|BE  mux=QUIC  flags=HTX|NO_UPG|FRAMED
       qmux : mode=HTTP  side=FE|BE  mux=QMUX  flags=HTX|NO_UPG
         h2 : mode=HTTP  side=FE|BE  mux=H2    flags=HTX|HOL_RISK|NO_UPG
         h1 : mode=HTTP  side=FE|BE  mux=H1    flags=HTX|NO_UPG
  <default> : mode=HTTP  side=FE|BE  mux=H1    flags=HTX
       fcgi : mode=HTTP  side=BE     mux=FCGI  flags=HTX|HOL_RISK|NO_UPG
       spop : mode=SPOP  side=BE     mux=SPOP  flags=HOL_RISK|NO_UPG
  <default> : mode=SPOP  side=BE     mux=SPOP  flags=HOL_RISK|NO_UPG
       none : mode=TCP   side=FE|BE  mux=PASS  flags=NO_UPG
  <default> : mode=TCP   side=FE|BE  mux=PASS  flags=

Available services : prometheus-exporter
Available filters :
	[BWLIM] bwlim-in
	[BWLIM] bwlim-out
	[CACHE] cache
	[COMP] comp-req
	[COMP] comp-res
	[COMP] compression
	[FCGI] fcgi-app
	[  OT] opentracing
	[SPOE] spoe
	[TRACE] trace

Last Outputs and Backtraces

No backtrace available: no debugger on the host, and HAProxy printed nothing before the crash.

Additional Information

Ubuntu 26.04, package 3.4.6-1ppa1~resolute from the vbernat PPA, x86_64. Reproduced as an unprivileged user with the configuration above.