CVE-2026-90678 HAProxy CVE debrief

Who should care

Defenders responsible for HAProxy configurations and security should assess exposure and prioritize verification of HAProxy versions and configurations. Security teams should monitor for potential HTTP request smuggling attempts and implement compensating controls to detect and prevent smuggled requests.

Why it matters

CVE-2026-90678 is a vulnerability in HAProxy that can lead to HTTP request smuggling on reused backend connections. Defenders should prioritize verifying HAProxy configurations and versions, as well as monitoring for potential HTTP request smuggling attempts. The vulnerability requires verification from official sources to determine affected versions and remediation steps.

• Potential HTTP request smuggling on reused backend connections
• Possible bypass of frontend rules such as path-based http-request deny
• Potential loss of concurrent clients' requests and their request lines and Authorization headers

Technical summary

The vulnerability arises from the way HAProxy handles HTTP/3 requests with no Content-Length header. When an HTTP/3 request is sent with a declared length in the DATA frame header that is larger than the actual payload, HAProxy announces a chunk larger than the bytes it writes. This can cause the connection to be returned to the idle pool in a desynchronized state, potentially allowing an attacker to smuggle requests past frontend rules.

Defensive priority

Defenders should prioritize verifying HAProxy configurations and versions, as well as monitoring for potential HTTP request smuggling attempts.

Recommended defensive actions

• Verify HAProxy configurations and versions to ensure they are not vulnerable
• Monitor for potential HTTP request smuggling attempts
• Implement compensating controls to detect and prevent smuggled requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was introduced in HAProxy 3.3-dev10 and affects versions 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend with QUIC support and a QUIC bind listener.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.