Description
An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced content-length when the stream is closed via a frame with an empty payload. This can cause desynchronization issues with the backend server and could be used for request smuggling. The earliest affected version is 2.6.
Exploits (1)
Scores
CVSS v3
4.0
EPSS
0.0001
EPSS Percentile
1.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Lab Environment
COMMUNITY
Community Lab
Details
CWE
CWE-130
Status
published
Products (1)
HAProxy/HAProxy
2.6 - 3.3.6
Published
Apr 13, 2026
Tracked Since
Apr 13, 2026