CVE-2026-93569 Red Hat CVE debrief

Who should care

Defenders of Netty-based proxies, gateways, and systems using affected Red Hat products should assess exposure and apply remediation. Relevant roles include security teams, network administrators, and DevOps engineers.

Why it matters

CVE-2026-93569 allows a remote unauthenticated attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests. Defenders should prioritize verifying affected systems, reviewing proxy configurations, and applying vendor remediation.

• Potential unauthorized access to sensitive data or systems
• Cache poisoning or misrouting of requests
• Bypassing of security controls in Netty-based proxies or gateways
• Verification of affected systems and proxy configurations

Technical summary

A flaw in Netty's HTTP/1 to HTTP/2 conversion process allows a remote unauthenticated attacker to override the request-target authority. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.

Defensive priority

Defenders should prioritize verifying affected Netty-based systems, reviewing proxy and gateway configurations, and applying vendor remediation.

Recommended defensive actions

• Verify affected Netty-based systems and proxy configurations
• Review and update security controls for HTTP/1 to HTTP/2 conversion
• Apply vendor remediation and patches
• Monitor for suspicious activity and misrouting of requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. Red Hat provides supplemental advisories and errata for affected products. Defenders should verify affected Netty-based systems, review proxy configurations, and apply vendor remediation. The vulnerability's impact on security controls and potential for unauthorized access necessitates thorough review and mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.