Malformed HTTP/2 CONNECT Vulnerability in Red Hat Products
CVE-2026-93567

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Build Of Apache Camel 3.33.3.sp2; Red Hat Build Of Quarkus 3.27.5.sp2; Red Hat Build Of Quarkus 3.33.3.sp2; Red Hat AMQ Broker 7
Vendor: CVE Published:; 18 September 2026

What is CVE-2026-93567?

A vulnerability exists in specific versions of Red Hat products where an improperly handled HTTP/1 authority-form CONNECT request is incorrectly processed as a malformed HTTP/2 CONNECT request. This issue can be exploited by attackers who control the :authority header, potentially leading to unauthorized access and data leakage. Proper measures should be taken to mitigate this security risk.