A flaw in HAProxy’s HTTP/3 parser fails to verify that the body length announced by the content-length header matches the actual payload length when a stream ends with an empty frame. The mismatch can desynchronize the communication between the proxy and its backend, potentially allowing an attacker to smuggle requests or manipulate request contents. This type of vulnerability is a classic example of data misinterpretation, identified here as CWE‑130.

All HAProxy installations running any version from 2.6 up to, but not including, 3.3.6 are affected. The problem is confined to the HTTP/3 implementation; systems that do not expose an HTTP/3 receptor to clients are not at risk through this flaw.

The CVSS score of 4.0 indicates moderate severity, and the absence of an EPSS value means the exact exploit probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation yet. Based on the description, it is inferred that an adversary would need network access to the HAProxy instance’s HTTP/3 interface and the ability to send tailored HTTP/3 frames that terminate a stream with zero payload.