CVE-2026-90678: HAProxy HTTP request smuggling in HTTP/3 multiplexer

CVE-2026-90678 · Severity: high · CVSS 7.5 · Published 2026-09-13

HAProxy is a widely-used load balancer and reverse proxy that routes web traffic between clients and backend servers. A vulnerability in its HTTP/3 multiplexer allows attackers to smuggle HTTP requests past security rules and hijack other clients' connections on reused backend links, potentially exposing sensitive data like authentication headers and request content. The attack requires specific configuration (HTTP/3 frontend with QUIC support and HTTP/1.1 backend using chunked encoding) and is non-deterministic but highly retryable.

Technologies: HAProxy. Vendors: HAProxy.

Quick answers

Is CVE-2026-90678 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-90678 being exploited in the wild.
How severe is CVE-2026-90678?
High severity, with a CVSS score of 7.5, published 13 September 2026.
Which products and versions are affected?
HAProxy 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5.
Is there a fix for CVE-2026-90678?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90678 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-90678?
Check whether you run HAProxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an HTTP request smuggling flaw in HAProxy's HTTP/3 multiplexer (introduced in 3.3-dev10) that occurs when processing DATA frames without a Content-Length header. The root cause is premature crediting of declared payload size to the stream endpoint before the payload is received, allowing a mismatch between declared and actual bytes when chunked transfer coding is used on HTTP/1.1 backend connections. An unauthenticated attacker can declare more payload in a DATA frame header than actually delivered, causing the HTTP/1.1 chunk size announcement to be desynchronized from what HAProxy actually writes. This leaves the connection in an inconsistent state, permitting subsequent requests on reused connections to be misinterpreted as the attacker's request body. Attack success requires HTTP/3 frontend with QUIC support, HTTP/1.1 backend with chunked encoding, and races with connection pooling; patches are expected in the public advisory.

Affected products

  • HAProxy HAProxy 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5

Timeline

  • 2026-09-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.