In HAProxy 3.3.0–3.4.4 and 3.5-dev1–3.5-dev5, an HTTP/3 frontend built with QUIC and a QUIC bind listener can desync reused backend HTTP/1.1 connections using chunked transfer coding when requests lack Content-Length. A remote client can smuggle requests past frontend rules and cause other clients’ request lines/Authorization to be consumed.