HTTP/3 Request Smuggling in HAProxy Before

Executive Summary

CVE-2026-33555 is a security flaw in HAProxy versions before 3.3.6 related to the HTTP/3 parser. The vulnerability occurs because HAProxy does not verify that the size of the received HTTP body matches the Content-Length header when the HTTP/3 stream is closed with an empty payload frame. This lack of validation can cause desynchronization between HAProxy and the backend server.

This desynchronization can be exploited to perform HTTP request smuggling attacks, where an attacker sends crafted requests that confuse the server into processing requests incorrectly or bypassing security controls.

The issue was fixed in HAProxy 3.3.6 by adding a check to validate the payload size even when parsing empty STREAM frames, ensuring the received body length matches the announced Content-Length.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to HTTP request smuggling attacks, which may allow an attacker to bypass security controls, manipulate backend server behavior, or cause unexpected processing of HTTP requests.

Such attacks can result in unauthorized access, data leakage, or interference with the normal operation of web applications behind the HAProxy load balancer.

Additionally, the desynchronization between HAProxy and backend servers caused by this flaw can lead to instability or unpredictable behavior in the handling of HTTP/3 traffic.

Useful 0 Not Useful 0

Detection Guidance

Detection of CVE-2026-33555 involves identifying desynchronization issues between HAProxy and backend servers caused by mismatched Content-Length headers in HTTP/3 streams. Since the vulnerability arises when HAProxy fails to verify that the received body length matches the announced Content-Length upon receiving an empty STREAM frame with the FIN bit set, monitoring for unusual HTTP/3 stream behavior or request smuggling attempts is key.

While no specific detection commands are provided in the resources, you can monitor HAProxy logs for anomalies related to HTTP/3 stream closures or errors indicating stream resets with HTTP/3 error code H3_MESSAGE_ERROR, which is part of the fix behavior.

Additionally, using HAProxy's CLI commands such as "show proc" and "show profiling" may help observe memory usage and error counters related to HTTP/3 parsing issues, as these commands were improved in the fixed version.

For network-level detection, inspecting HTTP/3 traffic for discrepancies between Content-Length headers and actual payload sizes, or signs of request smuggling attempts, could be done using packet capture tools like tcpdump or Wireshark with HTTP/3 and QUIC protocol analysis.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and immediate mitigation step is to upgrade HAProxy to version 3.3.6 or later, where the vulnerability has been fixed by adding proper validation of the Content-Length header against the received body size in HTTP/3 streams.

Alternatively, if using HAProxy ALOHA, upgrade to versions 17.5.22 or 18.0.1, which include the patched HAProxy releases addressing this vulnerability.

Until the upgrade can be applied, consider monitoring for suspicious HTTP/3 traffic patterns that may indicate exploitation attempts and restrict or closely inspect HTTP/3 traffic where feasible.

Review and apply any related security updates, including kernel updates and library updates (such as aws_lc), as noted in the changelogs accompanying the HAProxy fixes.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in HAProxy's HTTP/3 parser can cause desynchronization issues with backend servers and enable HTTP request smuggling attacks. Such attacks can potentially allow unauthorized manipulation or interception of HTTP requests.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, vulnerabilities that enable request smuggling and desynchronization could lead to unauthorized access or data integrity issues, which may impact compliance with regulations requiring data protection and secure communication.

Therefore, organizations using affected versions of HAProxy might face increased risk of non-compliance if this vulnerability is exploited, as it could undermine the confidentiality and integrity of data handled by the load balancer.

Useful 0 Not Useful 0