Vulnerability-Lookup

RHSA-2026:60634

Vulnerability from csaf_redhat - Published: 2026-08-27 21:38 - Updated: 2026-09-21 11:43

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: haproxy: * haproxy-3.0.27-0.1.hum1 (aarch64, x86_64) * haproxy-3.0.27-0.1.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-90678

A flaw was found in HAProxy. A remote, unauthenticated attacker can exploit a vulnerability in the HTTP/3 multiplexer when processing requests without a Content-Length header, leading to HTTP request smuggling. This occurs when HAProxy is configured with QUIC support and an HTTP/3 frontend, and traffic is routed to a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Successful exploitation allows the attacker to bypass frontend security rules and potentially intercept or cause the loss of other clients' requests, including sensitive information like authentication credentials.

8.9 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

12 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:60634	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-90678	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-90678	self
https://bugzilla.redhat.com/show_bug.cgi?id=2532644	external
https://www.cve.org/CVERecord?id=CVE-2026-90678	external
https://nvd.nist.gov/vuln/detail/CVE-2026-90678	external
http://git.haproxy.org/?p=haproxy.git;a=commit;h=…	external
https://github.com/haproxy/haproxy/commit/86a4ebc…	external
https://www.haproxy.org/download/3.5/src/CHANGELOG	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nhaproxy:\n  * haproxy-3.0.27-0.1.hum1 (aarch64, x86_64)\n  * haproxy-3.0.27-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:60634",
        "url": "https://access.redhat.com/errata/RHSA-2026:60634"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-90678",
        "url": "https://access.redhat.com/security/cve/CVE-2026-90678"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60634.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-09-21T11:43:35+00:00",
      "generator": {
        "date": "2026-09-21T11:43:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:60634",
      "initial_release_date": "2026-08-27T21:38:33+00:00",
      "revision_history": [
        {
          "date": "2026-08-27T21:38:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-14T10:44:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-21T11:43:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "haproxy-0:3.0.27-0.1.hum1@aarch64",
                "product": {
                  "name": "haproxy-0:3.0.27-0.1.hum1@aarch64",
                  "product_id": "haproxy-0:3.0.27-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/haproxy@3.0.27-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "haproxy-0:3.0.27-0.1.hum1@src",
                "product": {
                  "name": "haproxy-0:3.0.27-0.1.hum1@src",
                  "product_id": "haproxy-0:3.0.27-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/haproxy@3.0.27-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "haproxy-0:3.0.27-0.1.hum1@x86_64",
                "product": {
                  "name": "haproxy-0:3.0.27-0.1.hum1@x86_64",
                  "product_id": "haproxy-0:3.0.27-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/haproxy@3.0.27-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "haproxy-0:3.0.27-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@aarch64"
        },
        "product_reference": "haproxy-0:3.0.27-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "haproxy-0:3.0.27-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@src"
        },
        "product_reference": "haproxy-0:3.0.27-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "haproxy-0:3.0.27-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@x86_64"
        },
        "product_reference": "haproxy-0:3.0.27-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-90678",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-09-13T03:50:56.487823+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2532644"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in HAProxy. A remote, unauthenticated attacker can exploit a vulnerability in the HTTP/3 multiplexer when processing requests without a Content-Length header, leading to HTTP request smuggling. This occurs when HAProxy is configured with QUIC support and an HTTP/3 frontend, and traffic is routed to a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Successful exploitation allows the attacker to bypass frontend security rules and potentially intercept or cause the loss of other clients\u0027 requests, including sensitive information like authentication credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "haproxy: HAProxy: HTTP Request Smuggling via HTTP/3 Multiplexer Desynchronization",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in HAProxy that could lead to HTTP request smuggling. When HAProxy is configured with an HTTP/3 frontend, QUIC support, and a QUIC bind listener, and traffic is routed to an HTTP/1.1 backend using chunked transfer coding on reused connections, a remote unauthenticated attacker can desynchronize connections. This allows bypassing frontend security rules and potentially exposing sensitive data from other client requests.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@aarch64",
          "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@src",
          "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-90678"
        },
        {
          "category": "external",
          "summary": "RHBZ#2532644",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532644"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-90678",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-90678"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90678",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90678"
        },
        {
          "category": "external",
          "summary": "http://git.haproxy.org/?p=haproxy.git;a=commit;h=86a4ebc761a278838e8cb06f3a292282ba704c65",
          "url": "http://git.haproxy.org/?p=haproxy.git;a=commit;h=86a4ebc761a278838e8cb06f3a292282ba704c65"
        },
        {
          "category": "external",
          "summary": "https://github.com/haproxy/haproxy/commit/86a4ebc761a278838e8cb06f3a292282ba704c65",
          "url": "https://github.com/haproxy/haproxy/commit/86a4ebc761a278838e8cb06f3a292282ba704c65"
        },
        {
          "category": "external",
          "summary": "https://www.haproxy.org/download/3.5/src/CHANGELOG",
          "url": "https://www.haproxy.org/download/3.5/src/CHANGELOG"
        }
      ],
      "release_date": "2026-09-13T03:37:55.854000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-27T21:38:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@aarch64",
            "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@src",
            "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:60634"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid configuring HAProxy with a QUIC bind listener and HTTP/3 frontend if this functionality is not strictly required. If HTTP/3 is essential, consider reviewing HAProxy configurations to prevent backend connection reuse or the use of chunked transfer encoding over HTTP/1.1 for traffic susceptible to this flaw.",
          "product_ids": [
            "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@aarch64",
            "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@src",
            "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@aarch64",
            "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@src",
            "Red Hat Hardened Images:haproxy-0:3.0.27-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "haproxy: HAProxy: HTTP Request Smuggling via HTTP/3 Multiplexer Desynchronization"
    }
  ]
}

CVE-2026-90678 (GCVE-0-2026-90678)

Vulnerability from cvelistv5 – Published: 2026-09-13 03:37 – Updated: 2026-09-14 15:48

Summary

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client that declares more payload than it delivers and then ends the stream causes HAProxy to announce a chunk larger than the bytes it writes and to return the connection to the idle pool in a desynchronized state. The result is potential HTTP request smuggling on reused backend connections: an attacker can place a request past a frontend rule such as a path-based http-request deny, so that the smuggled request is never seen by HAProxy's HTTP analysis, and can cause concurrent clients' requests, including their request lines and Authorization headers, to be consumed as the attacker's request body and lost. Exploitation is not deterministic; it depends on a race with backend connection pooling, succeeding in a majority of but not all trials during testing, and can be retried freely. The mechanism was introduced in 3.3-dev10; releases 3.2.x and earlier are unaffected.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 15:47 UTC

CWE

CWE-130 - Improper Handling of Length Parameter Inconsistency

Assigner

mitre mitre root Scorecard

References

3 references

URL	Tags
https://github.com/haproxy/haproxy/commit/86a4ebc…	patch
http://git.haproxy.org/?p=haproxy.git;a=commit;h=…	patch
https://www.haproxy.org/download/3.5/src/CHANGELOG	release-notes

Impacted products

1 product

Vendor	Product	Version
HAProxy	HAProxy	Affected: 3.3.0 , ≤ 3.3.14 (semver) Affected: 3.4.0 , ≤ 3.4.4 (semver) Affected: 3.5-dev1 , ≤ 3.5-dev5 (custom) Unaffected: 3.5-dev6 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90678",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T15:47:26.078603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T15:48:00.475Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "HTTP/3 multiplexer",
            "HTTP/1 multiplexer"
          ],
          "product": "HAProxy",
          "programFiles": [
            "src/h3.c",
            "src/mux_h1.c"
          ],
          "programRoutines": [
            {
              "name": "h3_rcv_buf"
            }
          ],
          "vendor": "HAProxy",
          "versions": [
            {
              "lessThanOrEqual": "3.3.14",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.4.4",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.5-dev5",
              "status": "affected",
              "version": "3.5-dev1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "3.5-dev6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOnly deployments with an HTTP/3 frontend are affected. This requires HAProxy built with USE_QUIC=1 and at least one QUIC bind listener in a frontend; no experimental directives are needed to enable it. The affected code path is reached when such a request carries no Content-Length header and is forwarded to a backend over HTTP/1.1 with chunked transfer coding. Deployments without a QUIC listener are not exposed.\u003c/p\u003e"
            }
          ],
          "value": "Only deployments with an HTTP/3 frontend are affected. This requires HAProxy built with USE_QUIC=1 and at least one QUIC bind listener in a frontend; no experimental directives are needed to enable it. The affected code path is reached when such a request carries no Content-Length header and is forwarded to a backend over HTTP/1.1 with chunked transfer coding. Deployments without a QUIC listener are not exposed."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint\u0027s known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client that declares more payload than it delivers and then ends the stream causes HAProxy to announce a chunk larger than the bytes it writes and to return the connection to the idle pool in a desynchronized state. The result is potential HTTP request smuggling on reused backend connections: an attacker can place a request past a frontend rule such as a path-based http-request deny, so that the smuggled request is never seen by HAProxy\u0027s HTTP analysis, and can cause concurrent clients\u0027 requests, including their request lines and Authorization headers, to be consumed as the attacker\u0027s request body and lost. Exploitation is not deterministic; it depends on a race with backend connection pooling, succeeding in a majority of but not all trials during testing, and can be retried freely. The mechanism was introduced in 3.3-dev10; releases 3.2.x and earlier are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-130",
              "description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T03:37:55.854Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "BUG/MAJOR: h3: reject H3 truncated frames",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/haproxy/haproxy/commit/86a4ebc761a278838e8cb06f3a292282ba704c65"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "http://git.haproxy.org/?p=haproxy.git;a=commit;h=86a4ebc761a278838e8cb06f3a292282ba704c65"
        },
        {
          "name": "HAProxy 3.5-dev6 ChangeLog",
          "tags": [
            "release-notes"
          ],
          "url": "https://www.haproxy.org/download/3.5/src/CHANGELOG"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to a release or backported Enterprise version containing fix (\"BUG/MAJOR: h3: reject H3 truncated frames\"), first shipped in 3.5-dev6.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to a release or backported Enterprise version containing fix (\"BUG/MAJOR: h3: reject H3 truncated frames\"), first shipped in 3.5-dev6."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRemoving the QUIC bind listeners from all frontends eliminates exposure, since an HTTP/3 frontend is required. Releases in the 3.2 branch and earlier do not contain the mechanism.\u003c/p\u003e"
            }
          ],
          "value": "Removing the QUIC bind listeners from all frontends eliminates exposure, since an HTTP/3 frontend is required. Releases in the 3.2 branch and earlier do not contain the mechanism."
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-90678",
    "datePublished": "2026-09-13T03:37:55.854Z",
    "dateReserved": "2026-09-13T03:37:55.518Z",
    "dateUpdated": "2026-09-14T15:48:00.475Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:60634

CVE-2026-90678 (GCVE-0-2026-90678)

Tags

Sightings

Nomenclature

Related by attack behaviour