Malformed HTTP/2 CONNECT Vulnerability in Red Hat Products
CVE-2026-93567

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat AMQ Broker 7; Red Hat Build Of Apache Camel 4 For Quarkus 3; Red Hat Build Of Apache Camel For Spring Boot 4; Red Hat Build Of Apicurio Registry 3
Vendor: CVE Published:; 18 September 2026

What is CVE-2026-93567?

A vulnerability exists in specific versions of Red Hat products where an improperly handled HTTP/1 authority-form CONNECT request is incorrectly processed as a malformed HTTP/2 CONNECT request. This issue can be exploited by attackers who control the :authority header, potentially leading to unauthorized access and data leakage. Proper measures should be taken to mitigate this security risk.

References

https://access.redhat.com/security/cve/CVE-2026-93567

vdb-entryx_refsource_REDHAT

https://bugzilla.redhat.com/show_bug.cgi?id=2536955

issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 18, 2026
Vulnerability Reserved
Sep 18, 2026

CVE-2026-93567 Data

JSON