CVE-2026-90678 - HAProxy HTTP Request Smuggling Vulnerability
Brief
CVE ID : CVE-2026-90678
Published : Sept. 13, 2026, 4:17 a. m.
- 35 minutes ago
Description : An issue was discovered in HAProxy 3.
- 0 through 3.
- 4 and in 3. 5-dev1 through 3. 5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1. 1 using chunked transfer coding on a reused connection.
Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1. 1 chunk size.