HAProxy HTTP/3 Content-Length Validation Vulnerability Allowing Request Smuggling

A vulnerability exists in HAProxy versions prior to 3.3.6, including 2.6, within the HTTP/3 parser. The issue arises because the parser fails to verify that the received body length aligns with a previously declared content-length when the stream is terminated with a frame containing an empty payload. This oversight can lead to desynchronization with the backend server, potentially facilitating request smuggling exploits.

Impact

Exploitation of this vulnerability could cause desynchronization with the backend server, allowing for request smuggling attacks.

Remediation

Users can upgrade to HAProxy version 3.3.6 or later, or to version 2.6.25, which includes the necessary fix. Instructions for downloading these versions are available on the HAProxy website.