CVE-2026-90678

A flaw was found in HAProxy. A remote, unauthenticated attacker can exploit a vulnerability in the HTTP/3 multiplexer when processing requests without a Content-Length header, leading to HTTP request smuggling. This occurs when HAProxy is configured with QUIC support and an HTTP/3 frontend, and traffic is routed to a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Successful exploitation allows the attacker to bypass frontend security rules and potentially intercept or cause the loss of other clients' requests, including sensitive information like authentication credentials.

This is an Important flaw in HAProxy that could lead to HTTP request smuggling. When HAProxy is configured with an HTTP/3 frontend, QUIC support, and a QUIC bind listener, and traffic is routed to an HTTP/1.1 backend using chunked transfer coding on reused connections, a remote unauthenticated attacker can desynchronize connections. This allows bypassing frontend security rules and potentially exposing sensitive data from other client requests.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid configuring HAProxy with a QUIC bind listener and HTTP/3 frontend if this functionality is not strictly required. If HTTP/3 is essential, consider reviewing HAProxy configurations to prevent backend connection reuse or the use of chunked transfer encoding over HTTP/1.1 for traffic susceptible to this flaw.