Re: [Security Issue] An HTTP/3 client's declared DATA frame length is written verbatim as the HTTP/1.1 chunk size on a pooled backend connection, so one unauthenticated client can destroy other clients' requests and put a request of its own past a frontend deny rule

[Amaury Denoyelle]

On Thu, Sep 03, 2026 at 09:41:07AM +0530, Rajat Raghav wrote:
> SUMMARY
> In h3_rcv_buf(), for a request with no Content-Length, HAProxy credits the
> length a DATA frame header declares to the stream's known-input-payload
> estimate, at the moment that header is decoded. Line numbers are from 3.4.4.
> [...]

Hi,

Thanks for your report. This revealed a real issue with our HTTP/3
parser, which is triggered when a truncated frame is used. This was not
obvious to me at first while reading the report though. The provided
patch also seems not optimal. I thus provided my own one which should
prevent this issue and is now merged on top of the master branch.

  86a4ebc761a278838e8cb06f3a292282ba704c65 (ade-qns)
  BUG/MAJOR: h3: reject H3 truncated frames

If you have some time, do not hesitate to test it and report to me if
the issue can be considered as fixed.

Many thanks for your help,

-- 
Amaury Denoyelle