HTTP Request Smuggling Vulnerability in Netty by Red Hat
CVE-2026-93562

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat AMQ Broker 7
Red Hat AMQ Clients
Red Hat Build Of Apache Camel 4 For Quarkus 3
Red Hat Build Of Apache Camel For Spring Boot 4
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93562?

A flaw in the HTTP/1 decoder of Netty has been identified that allows remote attackers to exploit inadequate validation of malformed Transfer-Encoding headers. This vulnerability can lead to HTTP request smuggling, where attackers craft and inject malicious HTTP requests. Through this method, they can potentially bypass security measures, gain unauthorized access to sensitive resources, or manipulate a server's behavior. This issue emphasizes the importance of proper input validation and security controls in handling HTTP requests.

References

https://access.redhat.com/security/cve/CVE-2026-93562
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536951
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.