HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5.

CVE-2026-90678 is an HTTP request smuggling flaw in HAProxy’s HTTP/3-to-HTTP/1.1 gateway path. When a client sends an HTTP/3 request *without* a Content-Length header, the QUIC multiplexer trusts the length declared in the DATA frame header and emits it verbatim as the HTTP/1.1 Transfer-Encoding: chunked size — before the payload bytes actually arrive. An attacker who declares more payload than they deliver and then closes the QUIC stream leaves the backend connection in a desynchronized state: the announced chunk is larger than the bytes written, and HAProxy returns the poisoned connection to the idle pool. The flaw was introduced in 3.3-dev10 and affects all releases from 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5. Versions 3.2.x and earlier are unaffected.

The vendor’s HIGH / 7.5 score is well-calibrated. The AC:H reflects the non-deterministic race with the backend connection pool (the advisory notes exploitation “succeeds in a majority of but not all trials”). The S:C correctly flags that the victim is a *different* user whose request lands on the poisoned connection. The C:N is debatable — stolen Authorization headers are consumed as the attacker’s request body rather than reflected back, but with careful request crafting the attacker can arrange to receive responses containing that data. The score also does *not* fully account for the major narrowing prerequisite: HAProxy must be compiled with USE_QUIC=1 *and* configured with a QUIC bind listener. In enterprise deployments, HTTP/3 on HAProxy 3.3+ is still an early-adopter configuration, meaningfully shrinking the exposed population.

1. Disable QUIC/HTTP/3 listeners immediately — Remove quic@ / quic4@ / quic6@ bind directives from HAProxy frontend config and reload. Eliminates the attack surface entirely with zero functional impact for orgs that don’t need HTTP/3. Deploy within 30 days per the noisgate mitigation SLA for HIGH findings.
2. Pin backend protocol to HTTP/2 — Set server ... proto h2 in backend configuration. The desync only affects HTTP/1.1 chunked transfer coding on reused connections; HTTP/2 multiplexing uses a different framing model not susceptible to this mismatch.
3. Disable backend connection reuse for QUIC frontends — Add http-reuse never to backends served by QUIC-enabled frontends. Prevents the poisoned connection from being returned to the idle pool. Performance impact: higher backend connection churn, increased latency under load.
4. Deploy patched version (3.4.5 / 3.3.15 / 3.5-dev6) — Apply the vendor fix containing commit 86a4ebc761a278838e8cb06f3a292282ba704c65. This is the definitive remediation. Deploy within 180 days per the noisgate remediation SLA for HIGH findings.
5. Monitor backend logs for chunked-encoding anomalies — Alert on HTTP 400 errors from backends correlating with malformed Transfer-Encoding: chunked requests. Detection backstop, not prevention.

Run this on each HAProxy host as root (or any user with read access to the HAProxy binary and config file). Example: sudo bash check_cve_2026_90678.sh or sudo bash check_cve_2026_90678.sh /etc/haproxy/haproxy.cfg.

#!/usr/bin/env bash
# check_cve_2026_90678.sh — Detect exposure to CVE-2026-90678
# HAProxy HTTP/3 request smuggling via QUIC DATA frame length mismatch
# Run on: target HAProxy host | Privileges: read access to haproxy binary + config
# Output: VULNERABLE / PATCHED / UNKNOWN
set -euo pipefail

CONFIG="${1:-/etc/haproxy/haproxy.cfg}"
HAPROXY_BIN="$(command -v haproxy 2>/dev/null || echo '')"

if [[ -z "$HAPROXY_BIN" ]]; then
  echo "UNKNOWN — haproxy binary not found in PATH"
  exit 2
fi

# Get version
VERSION_RAW=$($HAPROXY_BIN -v 2>/dev/null | head -1)
VERSION=$(echo "$VERSION_RAW" | grep -oP '\d+\.\d+\.\d+' | head -1)
DEV_VERSION=$(echo "$VERSION_RAW" | grep -oP '\d+\.\d+-dev\d+' | head -1)

if [[ -z "$VERSION" && -z "$DEV_VERSION" ]]; then
  echo "UNKNOWN — could not parse HAProxy version from: $VERSION_RAW"
  exit 2
fi

# Check if compiled with QUIC support
QUIC_SUPPORT=$($HAPROXY_BIN -vv 2>/dev/null | grep -ci 'USE_QUIC=1' || true)

# Check if config has QUIC bind listeners
QUIC_BIND=0
if [[ -f "$CONFIG" ]]; then
  QUIC_BIND=$(grep -cE 'bind\s+.*quic[46]?@' "$CONFIG" 2>/dev/null || true)
fi

# Version comparison helper
verlte() { printf '%s\n' "$1" "$2" | sort -V | head -n1; }

VULN_VERSION=0
if [[ -n "$DEV_VERSION" ]]; then
  # Development version: 3.5-dev1 through 3.5-dev5 are vulnerable
  DEV_MAJOR=$(echo "$DEV_VERSION" | grep -oP '\d+\.\d+' | head -1)
  DEV_NUM=$(echo "$DEV_VERSION" | grep -oP 'dev\K\d+')
  if [[ "$DEV_MAJOR" == "3.5" && "$DEV_NUM" -ge 1 && "$DEV_NUM" -le 5 ]]; then
    VULN_VERSION=1
  fi
elif [[ -n "$VERSION" ]]; then
  MAJOR_MINOR=$(echo "$VERSION" | grep -oP '\d+\.\d+')
  if [[ "$MAJOR_MINOR" == "3.4" ]]; then
    PATCH=$(echo "$VERSION" | cut -d. -f3)
    [[ "$PATCH" -le 4 ]] && VULN_VERSION=1
  elif [[ "$MAJOR_MINOR" == "3.3" ]]; then
    PATCH=$(echo "$VERSION" | cut -d. -f3)
    [[ "$PATCH" -le 14 ]] && VULN_VERSION=1
  fi
fi

# Report
echo "HAProxy: ${VERSION:-$DEV_VERSION} | QUIC compiled: $([[ $QUIC_SUPPORT -gt 0 ]] && echo YES || echo NO) | QUIC bind: $([[ $QUIC_BIND -gt 0 ]] && echo YES || echo NO)"

if [[ "$VULN_VERSION" -eq 0 ]]; then
  echo "PATCHED — version ${VERSION:-$DEV_VERSION} is not in the affected range (3.3.0-3.4.4 / 3.5-dev1-dev5)"
  exit 0
fi

if [[ "$QUIC_SUPPORT" -eq 0 ]]; then
  echo "PATCHED — version is in range but binary not compiled with USE_QUIC=1; not exploitable"
  exit 0
fi

if [[ "$QUIC_BIND" -eq 0 ]]; then
  echo "PATCHED — version and binary affected but no QUIC bind listeners in $CONFIG; not exploitable unless config differs"
  exit 0
fi

echo "VULNERABLE — HAProxy ${VERSION:-$DEV_VERSION} with QUIC support enabled and QUIC bind listeners active"
exit 1

1. OpenCVE — CVE-2026-90678 Details
2. Strix AI — CVE-2026-90678 Advisory
3. OffSeq Threat Radar — CVE-2026-90678
4. NixOS nixpkgs — Fix PR #563806
5. HAProxy QUIC CVE Blog (CVE-2026-26080/26081)
6. Shadowserver — Accessible QUIC Report
7. Ubuntu Security Tracker — CVE-2026-90678
8. HAProxy endoflife.date