What’s Vulnerable › Vulnerabilities

CVE-2026-93562: Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-10-15
• Weakness: CWE-1035

Description

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.

Affected products

• Red Hat build of Keycloak 26.4: all versions
• Red Hat AMQ Broker 7: all versions
• Red Hat AMQ Clients: all versions
• Red Hat build of Apache Camel 4 for Quarkus 3: all versions
• Red Hat build of Apache Camel for Spring Boot 4: all versions
• Red Hat build of Apicurio Registry 3: all versions
• Red Hat Data Grid 8: all versions
• Red Hat JBoss Enterprise Application Platform 8: all versions

References

• https://access.redhat.com/errata/RHSA-2026:69440
• https://access.redhat.com/errata/RHSA-2026:69470
• https://access.redhat.com/errata/RHSA-2026:83612
• https://access.redhat.com/security/cve/CVE-2026-93562
• https://bugzilla.redhat.com/show_bug.cgi?id=2536951
• https://bugzilla.redhat.com/show_bug.cgi?id=2536951

Get alerted when CVE-2026-93562 or the next vulnerability affects your stack