A high-severity HTTP request smuggling vulnerability in HAProxy allows unauthenticated remote attackers to bypass security filters and potentially hijack sensitive client traffic.

The vulnerability resides in the HTTP/3 multiplexer, which incorrectly handles length declarations in DATA frame headers. An unauthenticated remote attacker can exploit this discrepancy to desynchronize backend connection pools, resulting in HTTP request smuggling.

Successful exploitation allows an attacker to bypass frontend security policies, such as path-based request denials, effectively rendering access control mechanisms useless. Furthermore, the ability to consume concurrent client traffic, including request lines and authorization headers, poses a severe risk of data exfiltration and unauthorized session access. The CVSS score of 7.5 reflects the high impact on system integrity and the potential for unauthorized access to sensitive data.

Immediate Action: Upgrade to a patched version or apply the vendor-provided backported fix ("BUG/MAJOR: h3: reject H3 truncated frames") first available in 3.5-dev6.

Proactive Monitoring: Monitor server logs for anomalous HTTP traffic patterns, particularly requests that result in unexpected backend connection errors or discrepancies in chunked transfer coding.

Compensating Controls: If patching is delayed, disable HTTP/3 (QUIC) support on the frontend to eliminate the vulnerable attack surface entirely.

Public Exploit Available: No (unknown)

This vulnerability presents a significant risk to the integrity of client-server communications for users of HAProxy. Organizations utilizing HAProxy with QUIC support should prioritize upgrading to the latest stable release to neutralize this smuggling vector. Given the potential for unauthorized access to sensitive headers and cross-user data exposure, this update should be treated as a high-priority maintenance task.