CVE-2026-93573 Red Hat CVE debrief

Who should care

Defenders responsible for Netty-based applications, particularly those using Red Hat build of Quarkus, Red Hat AMQ Broker, Red Hat AMQ Clients, and other affected products, should assess exposure and prioritize remediation.

Why it matters

Defenders should care about CVE-2026-93573 because it allows remote attackers to bypass security controls and desynchronize request processing in Netty-based applications, particularly those using Red Hat products. Affected versions and remediation details are not specified, requiring verification from official sources.

• Potential HTTP request smuggling attacks
• Bypassing of security controls
• Desynchronization of request processing
• Requests processed in unintended contexts

Technical summary

The vulnerability in Netty's HTTP/1.1 decoder allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.

Defensive priority

Defenders should prioritize verifying affected versions and applying vendor remediation to prevent potential HTTP request smuggling attacks.

Recommended defensive actions

• Verify affected versions of Netty and dependent products
• Apply vendor remediation from Red Hat for affected products
• Monitor for potential HTTP request smuggling attacks
• Review and update security controls to detect and prevent request smuggling
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify affected or fixed versions. Vendor advisories from Red Hat are available for affected products. Defenders should verify the affected scope, severity, and vendor guidance by reviewing the official advisory or CVE record. They should also check for potential HTTP request smuggling attacks and review compensating controls for exposed systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.