CVE-2026-90678: 
HAProxy vulnerability analysis and mitigation

CVE-2026-90678 is an HTTP request smuggling vulnerability in HAProxy caused by improper handling of HTTP/3 DATA frame length fields when proxying to HTTP/1.1 backends. It affects HAProxy versions 3.3.0 through 3.3.14, 3.4.0 through 3.4.4, and 3.5-dev1 through 3.5-dev5; versions 3.2.x and earlier are unaffected. The vulnerability was introduced in 3.3-dev10 and publicly disclosed on September 13, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-130 (Improper Handling of Length Parameter Inconsistency) and CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). When HAProxy is built with QUIC support and configured with an HTTP/3 frontend forwarding traffic to HTTP/1.1 backends over reused connections with chunked transfer encoding, the HTTP/3 multiplexer (h3.c) credits the payload length declared in a DATA frame header to the stream's known-input-payload estimate at the moment the frame header is decoded — before the actual payload bytes are received. This declared length is then emitted verbatim as the HTTP/1.1 chunk size. An attacker sends an HTTP/3 request without a Content-Length header, declares a large DATA frame length, delivers fewer bytes than declared, and then ends the stream (FIN), causing HAProxy to write a chunk size larger than the bytes actually forwarded and return the backend connection to the idle pool in a desynchronized state. The fix (commit 86a4ebc) adds checks in h3_rcv_buf() to detect truncated frames on FIN and immediately close the connection with H3_FRAME_ERROR per RFC 9114 §7.1 (GitHub Commit, GitHub Advisory).

A remote unauthenticated attacker can exploit this vulnerability to conduct HTTP request smuggling on reused backend connections, enabling them to bypass frontend access control rules (e.g., path-based http-request deny directives) that HAProxy would otherwise enforce. Additionally, concurrent legitimate clients' HTTP requests — including their request lines and Authorization headers — can be consumed as the attacker's request body and silently discarded, resulting in credential exposure and denial of service for affected clients. The scope is marked as Changed, reflecting that the impact extends beyond HAProxy itself to backend servers and other clients sharing the connection pool (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is non-deterministic — it depends on a race condition with backend connection pooling — but can be retried freely, making it practically feasible in targeted attacks. The EPSS score is approximately 0.52–0.77%, placing it in roughly the 54th percentile for exploitation probability within 30 days (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and automation as "no" as of September 2026.

1. Prerequisite verification: Confirm the target HAProxy instance is running versions 3.3.0–3.3.14, 3.4.0–3.4.4, or 3.5-dev1 through 3.5-dev5, is compiled with QUIC/HTTP3 support, has a QUIC bind listener configured on a frontend, and proxies to HTTP/1.1 backends with connection reuse enabled.
2. Establish HTTP/3 connection: Connect to the HAProxy QUIC listener using an HTTP/3-capable client (e.g., a custom QUIC client or curl with HTTP/3 support).
3. Craft malicious HTTP/3 request: Send an HTTP/3 request without a Content-Length header. Open a DATA frame and declare a large payload length in the frame header (e.g., 1000 bytes).
4. Deliver truncated payload: Write only a small number of actual payload bytes (e.g., 10 bytes) — far fewer than the declared DATA frame length.
5. Send FIN to end the stream: Terminate the QUIC stream with a FIN signal before delivering the remaining declared bytes, causing HAProxy to emit the full declared length as the HTTP/1.1 chunk size to the backend while only having written the partial payload.
6. Exploit desynchronized backend connection: The backend connection is now in a desynchronized state and returned to the idle pool. Craft a follow-up smuggled HTTP request (embedded in the "missing" chunk bytes) that bypasses HAProxy's frontend rules (e.g., a path that would normally be blocked by http-request deny).
7. Capture concurrent client data: Time additional requests from other clients to arrive while the backend connection is desynchronized, causing their request lines and Authorization headers to be consumed as the attacker's request body and logged or forwarded to the attacker-controlled backend path.
8. Retry as needed: Since exploitation depends on a race with connection pooling, repeat steps 3–7 until the smuggled request succeeds (GitHub Advisory, Red Hat Bugzilla).

• Network: Unusual QUIC/UDP traffic to HAProxy listeners followed by abnormally short DATA frame payloads relative to declared frame lengths; repeated connection attempts from the same source IP to the QUIC frontend in rapid succession (retry behavior).
• Logs: HAProxy logs showing backend connections returned to the idle pool immediately after incomplete request bodies; unexpected HTTP 400/502 errors for legitimate clients on reused backend connections; mismatched chunk sizes in backend access logs.
• Process/Application: Backend servers receiving requests with oversized Content-Length or chunk size values that do not match actual body bytes delivered; backend logs showing requests with truncated or missing bodies; Authorization header values appearing in unexpected request body fields on the backend.
• HAProxy Trace Logs (if verbose tracing enabled): H3_FRAME_ERROR or truncated frame on FIN trace messages in HAProxy debug output after applying the patch, which would indicate exploitation attempts against patched instances (GitHub Commit).

Upgrade HAProxy to a fixed version: 3.3.15 or later (3.3.x branch), 3.4.5 or later (3.4.x branch), or 3.5-dev6 or later. The fix is implemented in commit 86a4ebc which adds truncated-frame detection in the HTTP/3 multiplexer (GitHub Commit). As a temporary workaround if upgrading is not immediately possible: disable HTTP/3 QUIC frontends entirely, or restrict QUIC listener access to trusted networks only. Additionally, disabling backend connection reuse (option http-server-close or option forceclose) eliminates the desynchronization risk on reused connections (GitHub Advisory).

Red Hat has opened a high-severity bug tracking entry (Bug 2532644) and is assessing impact across its product portfolio, with 27 users CC'd on the issue (Red Hat Bugzilla). The vulnerability was credited to researcher Rajat Raghav in the HAProxy commit message (GitHub Commit). The GitHub Advisory Database has classified it as High severity, and Tenable has released a Nessus detection plugin (ID 345663) for the vulnerability.