HTTP/2 and HTTP/3 Vulnerability in Red Hat Products
CVE-2026-93568

7.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat AMQ Broker 7
Red Hat Build Of Apache Camel 4 For Quarkus 3
Red Hat Build Of Apache Camel For Spring Boot 4
Red Hat Build Of Apicurio Registry 3
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93568?

A vulnerability has been identified in Red Hat products involving HTTP/2 and HTTP/3. Specifically, Extended CONNECT requests are incorrectly downgraded to standard CONNECT requests. This mismanagement can lead to unexpected behavior concerning network protocols and may expose systems to potential security risks. Users of affected products should assess the impact and apply the relevant security measures as necessary.

References

https://access.redhat.com/security/cve/CVE-2026-93568
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536961
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.