CVE-2026-90678
Description
A flaw was found in HAProxy. A remote, unauthenticated attacker can exploit a vulnerability in the HTTP/3 multiplexer when processing requests without a Content-Length header, leading to HTTP request smuggling. This occurs when HAProxy is configured with QUIC support and an HTTP/3 frontend, and traffic is routed to a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Successful exploitation allows the attacker to bypass frontend security rules and potentially intercept or cause the loss of other clients' requests, including sensitive information like authentication credentials.
Statement
This is an Important flaw in HAProxy that could lead to HTTP request smuggling. When HAProxy is configured with an HTTP/3 frontend, QUIC support, and a QUIC bind listener, and traffic is routed to an HTTP/1.1 backend using chunked transfer coding on reused connections, a remote unauthenticated attacker can desynchronize connections. This allows bypassing frontend security rules and potentially exposing sensitive data from other client requests.
Mitigation
To mitigate this issue, avoid configuring HAProxy with a QUIC bind listener and HTTP/3 frontend if this functionality is not strictly required. If HTTP/3 is essential, consider reviewing HAProxy configurations to prevent backend connection reuse or the use of chunked transfer encoding over HTTP/1.1 for traffic susceptible to this flaw.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.9 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
