HTTP Request Smuggling Vulnerability in Netty's HTTP Component
CVE-2026-93574

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat AMQ Broker 7
Red Hat AMQ Clients
Red Hat Build Of Apache Camel 4 For Quarkus 3
Red Hat Build Of Apache Camel For Spring Boot 4
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93574?

A flaw exists in Netty's HTTP codec, specifically in the parsing of the chunk-size token within HTTP/1.1 requests. This vulnerability allows remote attackers to exploit improper handling of whitespace following the chunk-size value. When successfully exploited, it can result in HTTP request smuggling, enabling attackers to circumvent security controls and gain unauthorized access to resources behind proxy servers or backend systems. The implications can be severe, affecting the integrity and confidentiality of data processed by vulnerable applications.

References

https://access.redhat.com/security/cve/CVE-2026-93574
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536966
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.