Executive brief
HAProxy, a widely used load balancer and proxy server, contains a vulnerability in how it handles modern HTTP/3 web traffic. An attacker can send a specially crafted request that tricks the proxy into miscalculating the size of the data being sent. This can lead to 'request smuggling,' where an attacker can interfere with other users' web sessions, potentially bypassing security controls or accessing sensitive data on backend servers.
Technical details
A vulnerability in HAProxy's HTTP/3 (H3) implementation arises when a QUIC STREAM frame is received with no payload but with the FIN bit set. In this 'standalone FIN' code path, the parser (h3_rcv_buf) skips standard H3 validation and calls qcs_http_handle_standalone_fin() directly, bypassing the h3_check_body_size() check. If a request includes a Content-Length header but provides no body data before the FIN bit, HAProxy forwards the request to the backend while the backend continues to wait for the missing bytes. This allows an attacker to desynchronize the connection pool, causing the backend to interpret the beginning of a subsequent user's request as the missing body of the attacker's request. The issue is fixed in versions 3.3.6, 3.2.15, 3.0.19, 2.8.20, and 2.6.25.
Affected products
- HAProxy HAProxy 2.6 through 3.3.5
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory
- 2026-04-14: other: Detailed technical writeup published by researcher
- 2026-06-29: other: NIST analysis completed
References
- https://github.com/haproxy/haproxy/commit/05a295441c621089ffa4318daf0dbca2dd756a84
- https://r3verii.github.io/cve/2026/04/14/haproxy-h3-standalone-fin-smuggling.html
- https://www.haproxy.com/documentation/haproxy-aloha/changelog/
- https://www.haproxy.org/
- https://www.mail-archive.com/haproxy@formilux.org/msg46752.html