Vulnerability in Red Hat Amq Broker 7
CVE-2026-93569
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
Vulnerability class: HTTP Request Smuggling
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.
Affected products
- Red Hat Amq Broker 7
- Red Hat Build Of Apache Camel 4 For Quarkus 3
- Red Hat Build Of Apache Camel For Spring Boot 4
- Red Hat Build Of Apicurio Registry 3
- Red Hat Build Of Debezium 3
- Red Hat Build Of Keycloak
- Red Hat Build Of Quarkus
- Red Hat Data Grid 8
- Red Hat Fuse 7
- Red Hat Jboss Enterprise Application Platform 7
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vdb-entry)
- secalert@redhat.com (x_refsource_REDHAT, issue-tracking)
Frequently asked questions
- What is CVE-2026-93569?
- CVE-2026-93569 is a high-severity vulnerability in Red Hat Amq Broker 7, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 8.2/10. Published 2026-09-18.
- How severe is CVE-2026-93569?
- High severity. CVSS v3 base score is 8.2 out of 10.