CVE-2026-90678

haproxy: HAProxy: HTTP Request Smuggling via HTTP/3 Multiplexer Desynchronization

View on CVE.org
Published Sep 13, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client that declares more payload than it delivers and then ends the stream causes HAProxy to announce a chunk larger than the bytes it writes and to return the connection to the idle pool in a desynchronized state. The result is potential HTTP request smuggling on reused backend connections: an attacker can place a request past a frontend rule such as a path-based http-request deny, so that the smuggled request is never seen by HAProxy's HTTP analysis, and can cause concurrent clients' requests, including their request lines and Authorization headers, to be consumed as the attacker's request body and lost. Exploitation is not deterministic; it depends on a race with backend connection pooling, succeeding in a majority of but not all trials during testing, and can be retried freely. The mechanism was introduced in 3.3-dev10; releases 3.2.x and earlier are unaffected.

Analysis

AI-generated

Technical impact

The vulnerability arises when HAProxy, built with QUIC support and configured with an HTTP/3 frontend, estimates the payload length from a DATA frame header before the payload arrives and emits that length as an HTTP/1.1 chunk size. If the declared length exceeds the data written, HAProxy announces a chunk larger than the bytes it writes, leaving the connection in a desynchronized state. This can smuggle a request past HAProxy’s HTTP analysis, allowing an attacker to inject a request that is later interpreted by the backend as the body of a concurrent client request, potentially bypassing access controls and corrupting session data.

Affected Systems

The flaw affects HAProxy versions 3.3.0 through 3.4.4 and the development releases 3.5‑dev1 through 3.5‑dev5. The issue is only exploitable when the binary is built with QUIC support and a QUIC bind listener is configured for an HTTP/3 frontend. Earlier releases in the 3.2 branch and below are immune.

Risk and Exploitability

The potential for request smuggling and subsequent loss of confidentiality, integrity, and availability of other connections. EPSS not listed in the CISA KEV catalogue, suggesting a low exploitation probability at present. The exploit requires a remote, unauthenticated client to send an HTTP/3 request with a mismatched payload size and to time the transmission such that the it is nondeterministic but can be repeated freely once conditions are met.

Remediation

Vendor Solution

Upgrade to a release or backported Enterprise version containing fix ("BUG/MAJOR: h3: reject H3 truncated frames"), first shipped in 3.5-dev6.

Vendor Workaround

Removing the QUIC bind listeners from all frontends eliminates exposure, since an HTTP/3 frontend is required. Releases in the 3.2 branch and earlier do not contain the mechanism.

OpenCVE Recommended Actions

  • Upgrade HAProxy to a release containing the fix, such as from 3.5 Enterprise backport.
  • If upgrading is not feasible, remove QUIC bind listeners from all frontends to eliminate exposure to HTTP/3 request smuggling.
  • Alternatively, disable QUIC/HTTP/3 support entirely if it is not required, or reconfigure the frontends to avoid using HTTP/3 frontends while maintaining required services.

Generated by OpenCVE AI on September 15, 2026 at 17:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title HTTP/3 Request Smuggling Exploit via Chunk Length Mismatch in HAProxy haproxy: HAProxy: HTTP Request Smuggling via HTTP/3 Multiplexer Desynchronization
Weaknesses CWE-444
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Title HTTP/3 Request Smuggling Exploit via Chunk Length Mismatch in HAProxy
Type Values Removed Values Added
Title HTTP/3 Request Smuggling via Chunked Transfer Coding in HAProxy
Type Values Removed Values Added
First Time appeared Haproxy
Haproxy haproxy
Vendors & Products Haproxy
Haproxy haproxy
Type Values Removed Values Added
Title HTTP/3 Request Smuggling via Chunked Transfer Coding in HAProxy
Type Values Removed Values Added
Description An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client that declares more payload than it delivers and then ends the stream causes HAProxy to announce a chunk larger than the bytes it writes and to return the connection to the idle pool in a desynchronized state. The result is potential HTTP request smuggling on reused backend connections: an attacker can place a request past a frontend rule such as a path-based http-request deny, so that the smuggled request is never seen by HAProxy's HTTP analysis, and can cause concurrent clients' requests, including their request lines and Authorization headers, to be consumed as the attacker's request body and lost. Exploitation is not deterministic; it depends on a race with backend connection pooling, succeeding in a majority of but not all trials during testing, and can be retried freely. The mechanism was introduced in 3.3-dev10; releases 3.2.x and earlier are unaffected.
Weaknesses CWE-130
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L'}
Earlier changes (2)
Weaknesses
  • CWE-130

    Improper Handling of Length Parameter Inconsistency

  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Sep 14, 2026, 3:48 PM
Reserved
Sep 13, 2026, 3:37 AM

View source JSON

Updated
Sep 14, 2026, 3:47 PM

JSON

Status
Awaiting Analysis
Published
Sep 13, 2026, 4:17 AM
Modified
Sep 22, 2026, 7:56 PM

View source JSON

Severity
Important
Public date
Sep 13, 2026, 3:37 AM

View source Bugzilla JSON

Updated
Sep 15, 2026, 5:45 PM

JSON