Summary
CVE-2026-93569 is an HTTP request/response smuggling vulnerability (CWE-444, Inconsistent Interpretation of HTTP Requests) in Netty’s netty-codec-http2 module. When a proxy or gateway built on Netty converts an HTTP/1 absolute-form request into HTTP/2, the code in HttpConversionUtil.toHttp2Headers(...) incorrectly prioritizes the HTTP/1 Host header over the authority present in the absolute-form request-target, allowing the two to diverge. This host/authority confusion carries a High severity rating (CVSS 3.1: 8.2) and affects any application or middleware — including Red Hat AMQ Broker 7 and other Red Hat products that bundle the vulnerable Netty codec — that uses Netty to bridge HTTP/1 requests to HTTP/2 backends.
Technical details
- Root cause:
HttpConversionUtil.toHttp2Headers(...)in Netty’s HTTP/1-to-HTTP/2 conversion logic trusts the HTTP/1Hostheader over the authority specified in an absolute-form request line, rather than validating that the two match. - Trigger conditions: An attacker sends an HTTP/1.1 request using an absolute-form request-target (e.g.,
GET http://allowed.example/admin HTTP/1.1) paired with a mismatchedHostheader (e.g.,Host: blocked.example). A front-end control (firewall, allowlist, routing rule) may evaluate the request against the "allowed" authority in the request line, while the downstream HTTP/2 request is forwarded using the attacker-controlled:authorityvalue derived from the mismatchedHostheader. - Attack vector: Network-based (AV:N), no authentication required (PR:N), no user interaction (UI:N), low attack complexity (AC:L) — exploitable remotely against any Netty-based proxy, gateway, or reverse-proxy component that performs HTTP/1-to-HTTP/2 translation.
- Impact: High integrity impact (I:H) with low confidentiality impact (C:L) and no availability impact (A:N). Exploitation can enable web cache poisoning, bypass of host/tenant-based access controls or firewall rules, and unintended routing of requests to unauthorized backends or applications.
Affected software
io.netty:netty-codec-http2versions 4.1.0.Final through 4.1.137.Finalio.netty:netty-codec-http2versions 4.2.0.Final through 4.2.17.Final- Any downstream product bundling a vulnerable Netty version that performs HTTP/1-to-HTTP/2 conversion, including Red Hat products such as AMQ Broker 7, JBoss EAP 7 & 8, Fuse 7, Single Sign-On 7, Data Grid 8, Quarkus 3, Apache Camel 4 (for Spring Boot and Quarkus 3), Apicurio Registry 3, Debezium 3, and Red Hat Build of Keycloak
Severity
- CVSS v3.1 Base Score: 8.2 (High)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Mitigation and recommended actions
- Immediate: Upgrade
netty-codec-http2(and the broader Netty distribution) to a patched release — 4.1.138.Final or 4.2.18.Final or later. Apply the corresponding updated packages for any downstream distribution (e.g., Red Hat products) once vendor-specific patched builds are released. - If no patch is available yet: There are no official workarounds published for this vulnerability. Organizations that cannot immediately patch should:
- Avoid relying on Netty-based components as the sole gateway performing HTTP/1-to-HTTP/2 translation for security-sensitive routing or access-control decisions.
- Review and harden front-end proxies/firewalls to reject or normalize HTTP/1 requests where the absolute-form request-target authority and the
Hostheader do not match, before they reach Netty-based HTTP/2 backends. - Monitor for anomalous host/authority mismatches in access logs as an indicator of attempted exploitation.