Executive brief
HAProxy is a widely-used load balancer and reverse proxy that routes web traffic between clients and backend servers. A vulnerability in its HTTP/3 multiplexer allows attackers to smuggle HTTP requests past security rules and hijack other clients' connections on reused backend links, potentially exposing sensitive data like authentication headers and request content. The attack requires specific configuration (HTTP/3 frontend with QUIC support and HTTP/1.1 backend using chunked encoding) and is non-deterministic but highly retryable.
Technical details
The vulnerability is an HTTP request smuggling flaw in HAProxy's HTTP/3 multiplexer (introduced in 3.3-dev10) that occurs when processing DATA frames without a Content-Length header. The root cause is premature crediting of declared payload size to the stream endpoint before the payload is received, allowing a mismatch between declared and actual bytes when chunked transfer coding is used on HTTP/1.1 backend connections. An unauthenticated attacker can declare more payload in a DATA frame header than actually delivered, causing the HTTP/1.1 chunk size announcement to be desynchronized from what HAProxy actually writes. This leaves the connection in an inconsistent state, permitting subsequent requests on reused connections to be misinterpreted as the attacker's request body. Attack success requires HTTP/3 frontend with QUIC support, HTTP/1.1 backend with chunked encoding, and races with connection pooling; patches are expected in the public advisory.
Affected products
- HAProxy HAProxy 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5
Timeline
- 2026-09-13: disclosed