An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. (CVE-2026-90678)
An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client that declares more payload than it delivers and then ends the stream causes HAProxy to announce a chunk larger than the bytes it writes and to return the connection to the idle pool in a desynchronized state. The result is potential HTTP request smuggling on reused backend connections: an attacker can place a request past a frontend rule such as a path-based http-request deny, so that the smuggled request is never seen by HAProxy's HTTP analysis, and can cause concurrent clients' requests, including their request lines and Authorization headers, to be consumed as the attacker's request body and lost. Exploitation is not deterministic; it depends on a race with backend connection pooling, succeeding in a majority of but not all trials during testing, and can be retried freely. The mechanism was introduced in 3.3-dev10; releases 3.2.x and earlier are unaffected.
AI Analysis
Technical Summary
CVE-2026-90678 affects HAProxy versions 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5 when configured with an HTTP/3 frontend built with QUIC support and backend HTTP/1.1 chunked transfer coding on reused connections. The vulnerability arises because the HTTP/3 multiplexer credits the length declared in a DATA frame header before receiving the payload, emitting this length verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client can declare more payload than delivered and end the stream, causing HAProxy to announce a chunk larger than the actual bytes sent and return the connection to the idle pool in a desynchronized state. This enables HTTP request smuggling, allowing attackers to bypass frontend rules and cause concurrent clients' requests to be misinterpreted or lost. Exploitation depends on a race condition with backend connection pooling and is not guaranteed but often successful. The flaw was introduced in 3.3-dev10; earlier versions are unaffected.
Potential Impact
The vulnerability allows remote unauthenticated attackers to perform HTTP request smuggling on backend connections reused by HAProxy. This can bypass frontend HTTP request filtering rules, potentially allowing unauthorized requests to reach backend services. Additionally, concurrent client requests may be consumed incorrectly, leading to loss of request lines and Authorization headers, which can disrupt normal request processing and compromise security controls. The impact is high due to the ability to bypass access controls and interfere with request handling, although there is no direct confidentiality impact reported.
Mitigation Recommendations
No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling HTTP/3 frontends with QUIC support or avoid configurations that use HTTP/1.1 chunked transfer coding on reused backend connections. Monitoring for unusual backend connection behavior and avoiding reuse of connections in vulnerable configurations may reduce risk.
An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. (CVE-2026-90678)
Description
An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client that declares more payload than it delivers and then ends the stream causes HAProxy to announce a chunk larger than the bytes it writes and to return the connection to the idle pool in a desynchronized state. The result is potential HTTP request smuggling on reused backend connections: an attacker can place a request past a frontend rule such as a path-based http-request deny, so that the smuggled request is never seen by HAProxy's HTTP analysis, and can cause concurrent clients' requests, including their request lines and Authorization headers, to be consumed as the attacker's request body and lost. Exploitation is not deterministic; it depends on a race with backend connection pooling, succeeding in a majority of but not all trials during testing, and can be retried freely. The mechanism was introduced in 3.3-dev10; releases 3.2.x and earlier are unaffected.
CVSS v3.1
Score 7.5high
Affected software
pkg:github/haproxy/haproxyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90678 affects HAProxy versions 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5 when configured with an HTTP/3 frontend built with QUIC support and backend HTTP/1.1 chunked transfer coding on reused connections. The vulnerability arises because the HTTP/3 multiplexer credits the length declared in a DATA frame header before receiving the payload, emitting this length verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client can declare more payload than delivered and end the stream, causing HAProxy to announce a chunk larger than the actual bytes sent and return the connection to the idle pool in a desynchronized state. This enables HTTP request smuggling, allowing attackers to bypass frontend rules and cause concurrent clients' requests to be misinterpreted or lost. Exploitation depends on a race condition with backend connection pooling and is not guaranteed but often successful. The flaw was introduced in 3.3-dev10; earlier versions are unaffected.
Potential Impact
The vulnerability allows remote unauthenticated attackers to perform HTTP request smuggling on backend connections reused by HAProxy. This can bypass frontend HTTP request filtering rules, potentially allowing unauthorized requests to reach backend services. Additionally, concurrent client requests may be consumed incorrectly, leading to loss of request lines and Authorization headers, which can disrupt normal request processing and compromise security controls. The impact is high due to the ability to bypass access controls and interfere with request handling, although there is no direct confidentiality impact reported.
Mitigation Recommendations
No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling HTTP/3 frontends with QUIC support or avoid configurations that use HTTP/1.1 chunked transfer coding on reused backend connections. Monitoring for unusual backend connection behavior and avoiding reuse of connections in vulnerable configurations may reduce risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9f9v-4h96-wh6m
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90678"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6aa741aa55bf5e2cf548a602
Added to database: 09/14/2026, 00:36:58 UTC
Last enriched: 09/14/2026, 00:44:05 UTC
Last updated: 09/14/2026, 02:03:07 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.