CVE-2026-90678 | CVSS: 7.5 | 严重级别: HIGH
An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload ha
参考链接:
• http://git.haproxy.org/?p=haproxy.git;a=commit;h=86a4ebc761a278838e8cb06f3a29228
• https://github.com/haproxy/haproxy/commit/86a4ebc761a278838e8cb06f3a292282ba704c
• https://www.haproxy.org/download/3.5/src/CHANGELOG
📌 数据来源: NVD 官方