Overview

CVE-2026-90678 is a vulnerability affecting HAProxy, a widely used load balancer and reverse proxy server. The vulnerability is related to the HTTP/3 multiplexer and HTTP/1.1 chunked transfer coding, allowing for potential HTTP request smuggling on reused backend connections. This could enable an attacker to bypass security rules and cause data loss.

Understanding the Vulnerability / Threat

Root Cause Analysis

The root cause of CVE-2026-90678 lies in the way HAProxy handles HTTP/3 requests with no Content-Length header. When an HTTP/3 request is made without a Content-Length header, the HTTP/3 multiplexer credits the length declared in the DATA frame header to the stream endpoint's known-input-payload estimate. If the declared length exceeds the actual payload delivered, HAProxy announces a chunk larger than the bytes written and returns the connection to the idle pool in a desynchronized state. This vulnerability belongs to the CWE-130 category, which involves improper handling of special elements in input.

Attack Surface & Vector

The attack surface for CVE-2026-90678 involves the following conditions: - HAProxy must be built with QUIC support and configured with a QUIC bind listener. - The affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. The attack vector is remote and unauthenticated, with the attacker needing to declare more payload than they deliver and then end the stream.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Exploiting CVE-2026-90678 for HTTP Request Smuggling 1. Initial Position: The attacker has network access to the HAProxy server and can send HTTP/3 requests. 2. Triggering the Flaw: The attacker sends an HTTP/3 request with no Content-Length header, declaring a payload length that exceeds the actual payload. The request is routed through a QUIC bind listener and reaches a backend over HTTP/1.1 using chunked transfer coding on a reused connection. 3. What Breaks: HAProxy announces a chunk larger than the bytes written and returns the connection to the idle pool in a desynchronized state, allowing for potential HTTP request smuggling. 4. Attacker's Prize: The attacker can place a request past a frontend rule, such as a path-based http-request deny, causing concurrent clients' requests to be consumed as the attacker's request body and lost.

Real-World Impact

The successful exploitation of CVE-2026-90678 can lead to HTTP request smuggling, allowing an attacker to bypass security rules and potentially cause data loss. The attack is not deterministic and depends on a race with backend connection pooling, but it can be retried freely.

Detection & Defense

Immediate Mitigations

- Upgrade HAProxy to version 3.3.14 or later, 3.4.5 or later, or 3.5-dev6 or later. - Ensure that HAProxy is not configured with a QUIC bind listener if not necessary.

Detection Strategies

- Monitor for unusual patterns in HTTP/1.1 chunked transfer coding. - Implement SIEM rules to detect anomalies in HAProxy logs. - Use network signatures to identify potential HTTP request smuggling attempts.

Long-Term Hardening

- Implement a Web Application Firewall (WAF) to detect and prevent HTTP request smuggling attacks. - Regularly update and patch HAProxy to the latest version. - Limit the use of reused connections and enforce proper connection closure.

Key Takeaways

- CVE-2026-90678 is a vulnerability in HAProxy that allows for HTTP request smuggling on reused backend connections. - The vulnerability is triggered by an HTTP/3 request with no Content-Length header and a declared payload length that exceeds the actual payload. - Immediate mitigations include upgrading HAProxy to a patched version and ensuring proper configuration. - Detection strategies involve monitoring for unusual patterns in HAProxy logs and implementing SIEM rules. - Long-term hardening includes implementing a WAF and regularly updating HAProxy.

Sources

- National Vulnerability Database (NVD) - CVE-2026-90678