HTTP/2 Stack Vulnerability in Netty Affects Multiple Applications
CVE-2026-93579

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat AMQ Broker 7
Red Hat Build Of Apache Camel 4 For Quarkus 3
Red Hat Build Of Apache Camel For Spring Boot 4
Red Hat Build Of Apicurio Registry 3
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93579?

A flaw in the validation of HTTP/2 header field values within Netty allows remote attackers to inject disallowed characters such as NUL, Line Feed, and Carriage Return. This weakness can be exploited when transitioning requests from HTTP/2 to HTTP/1.1, potentially enabling attackers to execute request smuggling, header injection, or response splitting attacks. The consequences could include unauthorized access to sensitive data, manipulation of user inputs, or other significant security threats.

References

https://access.redhat.com/security/cve/CVE-2026-93579
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2536970
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.