CVE-2026-90678

Executive Summary

CVE-2026-90678 is an HTTP request smuggling vulnerability in HAProxy versions 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5, rated CVSS 7.5 (High). The flaw resides in the HTTP/3 multiplexer's handling of DATA frame header length declarations when forwarding requests to HTTP/1.1 backends using chunked transfer coding — a remote, unauthenticated attacker can desynchronize reused backend connections, bypass frontend access-control rules, and cause other clients' requests (including Authorization headers) to be consumed as attacker-controlled body data. Exploitation is race-dependent and therefore non-deterministic but reportedly succeeds in a majority of trials, and no public PoC, Nuclei template, or exploit code is currently available.

Technical Analysis

HAProxy is a widely deployed open-source load balancer and reverse proxy that terminates HTTP/3 (QUIC) sessions on frontend listeners and can proxy those requests to HTTP/1.1 backend servers. CVE-2026-90678 (CWE-130, "Improper Handling of Length Parameter Inconsistency") arises at the boundary between the HTTP/3 and HTTP/1.1 protocol stacks.

Per the NVD description, the vulnerable flow requires all of the following conditions to be simultaneously true:

1. HTTP/3 frontend: HAProxy must be compiled with QUIC support and configured with a QUIC bind listener. This is not enabled by default; only deployments that explicitly enable HTTP/3 frontends are exposed.
2. HTTP/1.1 backend using chunked transfer coding: The affected traffic must be routed to a backend over HTTP/1.1 with chunked framing negotiated on a reused (pooled) connection.
3. No Content-Length header on the HTTP/3 request: The request arriving over HTTP/3 must omit a Content-Length header, forcing HAProxy to derive the forwarded body framing from other signals.

When these conditions hold, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded — that is, before the actual payload bytes have been received. That declared length is then emitted verbatim as the HTTP/1.1 chunk size. If the client declares more payload than it actually delivers and then ends the stream, HAProxy announces a chunk larger than the number of bytes it writes to the backend, then returns the connection to the idle pool while the connection is in a desynchronized state.

This is a classic request-smuggling primitive: the backend believes a chunk of size N is in flight but receives fewer bytes, so the boundaries between successive requests on that connection are misaligned. The next request written to the pooled connection — whether by the attacker or by a concurrent, unrelated client — is parsed by the backend in a way the frontend never modeled.

The vulnerability class is length-inconsistency / framing desynchronization between two protocol encodings (HTTP/3 DATA length vs. HTTP/1.1 chunk size). The critical detail is the ordering defect: the payload-length estimate is committed at frame-header decode time rather than after full payload receipt and verification against the stream's actual byte count.

The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L) reflects:

• AV:N — exploitable over the network.
• AC:H — high attack complexity due to the race with backend connection pooling.
• PR:N / UI:N — no privileges or user interaction required.
• S:C — scope changed: the vulnerable component's defect impacts resources beyond its own security authority (the backend server and concurrent clients).
• C:N / I:H / A:L — no direct confidentiality loss to the attacker's own request path, but high integrity impact (request smuggling alters what the backend processes) and low availability impact (concurrent clients' requests can be lost).

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-90678. The attack chain below is inferred strictly from the NVD description and the vulnerability class (HTTP request smuggling via length inconsistency). No function names, endpoints, or parameters beyond those explicitly stated in the NVD text are asserted.

1) Reconnaissance / target identification An attacker identifies an HAProxy instance with an HTTP/3 (QUIC) frontend. Signals include UDP/443 QUIC responses, Alt-Svc headers advertising h3, and HAProxy identification via response headers or banners. The attacker also needs to determine — or assume — that the backend is reached over HTTP/1.1 with chunked transfer coding and connection reuse. Exact version fingerprinting (3.3.0–3.4.4, 3.5-dev1–3.5-dev5) narrows the target set.

2) Triggering the specific flaw The attacker sends an HTTP/3 request that (a) carries no Content-Length header and (b) includes a DATA frame whose header declares a payload length larger than the bytes the attacker actually transmits. Because HAProxy commits that declared length to the stream's known-input-payload estimate at frame-header decode time, it forwards the declared size as the HTTP/1.1 chunk size before the body is complete. The attacker then ends the stream early (declaring more than delivered).

3) Payload / execution at the vulnerability-class level HAProxy writes fewer bytes than the chunk size it announced to the backend, then returns the desynchronized connection to the idle pool. On that connection, the leftover/mismatched framing means the next bytes are interpreted by the backend as part of the previous request body. The attacker can place a request past a frontend rule — for example, past a path-based http-request deny — so the smuggled request is never seen by HAProxy's HTTP analysis layer. Because exploitation races with backend connection pooling (the connection must be reused at the right moment), success is not deterministic but was reported to succeed in a majority of trials and can be retried.

4) Post-exploitation impact

• Access-control bypass: requests denied at the frontend (e.g., path-based denies) reach the backend anyway.
• Request/response queue poisoning: concurrent clients' requests — including their request lines and Authorization headers — are consumed as the attacker's request body and lost, enabling credential exposure on the wire, session disruption, and potential privilege abuse depending on backend behavior.
• Persistence of the primitive: because the smuggled request is invisible to HAProxy's HTTP analysis, downstream logging and WAF coverage are bypassed for those requests.

No public evidence of exploitation in the wild, no CISA KEV listing, and no attributed threat-actor campaign currently exists for this CVE.

Impact Assessment

Business impact: Organizations terminating HTTP/3 on HAProxy and proxying to HTTP/1.1 chunked backends face a smuggling primitive that can bypass frontend authorization rules and leak or destroy other users' requests. The "scope changed" CVSS metric captures a key risk: a defect in HAProxy's framing affects the integrity of requests processed by the backend and the confidentiality of concurrent clients' data.

Affected systems: HAProxy 3.3.0–3.4.4 and 3.5-dev1–3.5-dev5 built with QUIC support and configured with a QUIC bind listener, forwarding to HTTP/1.1 backends with chunked transfer coding and connection reuse. Deployments with HTTP/3 disabled, or those forwarding to HTTP/2-only backends, are not exposed by this specific path.

Blast radius: Any multi-tenant or shared HTTP/3 → HTTP/1.1 proxy deployment where connection pooling is active. Because the smuggled request bypasses http-request rules, security controls enforced solely at the HAProxy frontend (path-based denies, certain ACLs) provide no protection on the poisoned connection.

CVSS subscores: AC:H reflects the required race with connection pooling; S:C reflects impact extending to the backend and other clients; I:H reflects the high integrity impact of smuggling; A:L reflects concurrent-request loss. There is no C/N because the vector models the attacker's own channel, though practical Authorization-header exposure to other clients is a real secondary concern described in the advisory text.

Detection Guidance

Detection is challenging because successful smuggling deliberately bypasses frontend HTTP parsing and logging. Detections below combine protocol-anomaly checks (HTTP/3 frames vs. HTTP/1.1 chunk size mismatch), proxy-log heuristics, and backend-side desynchronization indicators. These rules are heuristic and should be tuned; no vendor-supplied signatures exist.

Sigma Rule

title: Potential HAProxy HTTP/3 to HTTP/1.1 Request Smuggling (CVE-2026-90678)
id: 8c2f1a44-9d7b-4e21-b6a3-90678cve2026
status: experimental
description: Detects HAProxy log or backend anomalies consistent with chunk-size/length desynchronization on reused backend connections when an HTTP/3 frontend forwards to an HTTP/1.1 chunked backend.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90678
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: haproxy
  service: http
detection:
  selection_truncated_body:
    http_request_body_truncated: true
  selection_chunk_mismatch:
    message|contains:
      - 'chunk size'
      - 'chunked'
  selection_status:
    status|contains:
      - '400'
      - '502'
  condition: selection_truncated_body and selection_chunk_mismatch and selection_status
falsepositives:
  - Client disconnects mid-upload over HTTP/3
  - Legitimate large multipart uploads interrupted by network errors
level: medium
tags:
  - attack.t1190
  - cve.2026-90678

YARA Rule

rule CVE_2026_90678_HAProxy_HTTP3_Smuggling_Indicators
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Heuristic indicators for CVE-2026-90678 HAProxy HTTP/3 DATA-frame length vs HTTP/1.1 chunk size inconsistency. Scans logs/captures for the version set and framing keywords."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90678"
        date = "2026-01-01"
        cve = "CVE-2026-90678"

    strings:
        $h3 = "HTTP/3" ascii wide nocase
        $quic = "QUIC" ascii wide nocase
        $chunk = "chunked" ascii wide nocase
        $cl = "Content-Length" ascii wide nocase
        $v33 = "HAProxy/3.3." ascii
        $v34 = "HAProxy/3.4." ascii
        $v35dev = "HAProxy/3.5-dev" ascii
        $deny = "http-request deny" ascii wide nocase

    condition:
        uint16(0) == 0x0a0d and
        ( $h3 and $quic and $chunk ) or
        ( $cl and ( $v33 or $v34 or $v35dev ) and $deny )
}

Suricata IDS Rule

alert http3 any any -> any any (msg:"CVE-2026-90678 HAProxy HTTP/3 to HTTP/1.1 request smuggling - DATA length / chunk size mismatch attempt"; flow:to_server; app-layer-protocol:http3; content:"HAProxy"; http_header; pcre:"/(?i)HAProxy\/3\.(3\.|4\.)|HAProxy\/3\.5-dev/"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-90678; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-90678; sid:9067801; rev:1;)

alert http any any -> any any (msg:"CVE-2026-90678 possible request smuggling - chunked backend with oversized/truncated chunk size"; flow:established,to_server; app-layer-protocol:http; http.header; content:"Transfer-Encoding|3a| chunked" nocase; pcre:"/^[0-9a-fA-F]{4,}\r\n/"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-admin; reference:cve,2026-90678; sid:9067802; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "quic" and destination.port == 443 and http.request.body.bytes == 0 ]
  [ network where network.protocol == "http" and http.request.headers contains "Transfer-Encoding" and http.request.headers contains "chunked" and http.response.status_code == 400 ]
  [ network where network.protocol == "http" and http.response.status_code == 502 ]

Note: field names above are illustrative of an EQL network/HTTP dataset; map to your actual Elastic Common Schema fields (e.g., http.request.mime_type, url.path). The intent is to correlate an HTTP/3 request with zero delivered body against downstream chunked-framing errors on the HTTP/1.1 backend within a short window on the same source.

Splunk SPL Query

index=haproxy OR index=proxy
| search (proto="h3" OR protocol="HTTP/3" OR quic="true")
| rex field=_raw "chunk\s+size[=:]\s*(?<chunk_size>\d+)"
| rex field=_raw "bytes_written[=:]\s*(?<bytes_written>\d+)"
| eval mismatch = if(isnotnull(chunk_size) AND isnotnull(bytes_written) AND chunk_size > bytes_written, 1, 0)
| where mismatch=1 OR (status IN (400,502) AND match(_raw, "(?i)chunk"))
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses by src_ip, dest_ip, dest_port
| where count >= 3
| sort - count
| table first_seen last_seen src_ip dest_ip dest_port statuses count

Wazuh OSSEC Rule

<group name="haproxy,cve-2026-90678,web,">
  <rule id="906780" level="10">
    <decoded_as>json</decoded_as>
    <field name="program">\.*haproxy</field>
    <regex type="pcre2">(?i)(chunk size|chunked).{0,80}(mismatch|truncat|larger than|desync)</regex>
    <description>CVE-2026-90678: HAProxy HTTP/3 to HTTP/1.1 chunk-size/length desynchronization indicator detected.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="906781" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">\.*haproxy</field>
    <field name="status">400|502</field>
    <regex type="pcre2">(?i)(HTTP/3|h3|quic)</regex>
    <description>CVE-2026-90678: HTTP/3 frontend request followed by HTTP/1.1 backend framing error (potential smuggling).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch, fixed version, or workaround has been identified by any tracked source. The version ranges in the advisory (3.3.0–3.4.4, 3.5-dev1–3.5-dev5) indicate the defect exists in all currently listed releases; organizations should treat every version in that range as affected until the HAProxy project publishes an advisory.

1) Immediate mitigations

• Disable HTTP/3/QUIC frontends where not strictly required. Exploitation requires a QUIC bind listener; removing or disabling it eliminates the attack path for this CVE.
• Force backend traffic away from HTTP/1.1 chunked framing on reused connections where feasible — e.g., use HTTP/2 or HTTP/1.1 with Content-Length, and evaluate disabling backend connection reuse (pooling) for HTTP/3-originated traffic. This directly removes the "reused connection with chunked transfer coding" precondition.
• Enforce authorization at the backend, not solely at the HAProxy frontend. Since the primitives bypass http-request rules such as path-based denies, replicate critical access controls behind the proxy.
• Apply egress/ingress filtering and rate limiting on QUIC endpoints, and monitor for repeated smuggling attempts (non-deterministic exploitation encourages retries).

2) Patch / upgrade steps

• Monitor the HAProxy project's security advisories and release channels for a fixed version covering 3.3.x, 3.4.x, and the 3.5-dev line.
• When a fix is released, upgrade promptly and re-verify that HTTP/3 frontends still function with backend chunked framing.
• If the project publishes a configuration-level workaround in its advisory, apply it immediately and equally to all nodes behind load balancers.

3) Long-term hardening

• Standardize backend protocols to eliminate mixed HTTP/3 → HTTP/1.1 chunked transitions, or enforce strict length validation at the proxy layer.
• Deploy defense-in-depth request-validation at the backend and add protocol-anomaly detection (as in the detection rules above) at both proxy and backend tiers.
• Maintain an inventory of QUIC-enabled edge configurations, since default-disabled HTTP/3 support is easy to overlook during patch triage.
• Track CVE-2026-90678 in vulnerability management and re-evaluate patch confidence as vendor evidence emerges; test any future fix in a lab that reproduces the HTTP/3 → HTTP/1.1 chunked pooled-connection path.

References

1. NVD — CVE-2026-90678: https://nvd.nist.gov/vuln/detail/CVE-2026-90678
2. HAProxy project security advisories and release notes: https://www.haproxy.org/ (consult for the eventual fixed version in the 3.3.x / 3.4.x / 3.5-dev lines)
3. CWE-130 — Improper Handling of Length Parameter Inconsistency: https://cwe.mitre.org/data/definitions/130.html
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (check for future listing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild status: No public PoC, exploit code, Nuclei template, or CISA KEV entry exists for CVE-2026-90678 at the time of writing. No threat-actor campaign has been attributed. The advisory notes exploitation is race-dependent and succeeded in a majority of trials during testing, with retries possible — meaning weaponization is plausible once technical details circulate, and defenders should prioritize mitigation for internet-facing HTTP/3 HAProxy deployments.