CVE-2026-93566 describes a flaw in Netty where an attacker can send a specially crafted HTTP request with control characters in the chunk-size line to bypass strict validation. This vulnerability enables HTTP request smuggling attacks, potentially resulting in information disclosure or other unauthorized actions. The vulnerability is present in multiple specific Netty versions as enumerated in the affectedVersions field. There is no information provided about available patches or vendor advisories.

Exploitation of this vulnerability can lead to HTTP request smuggling, which may allow attackers to perform unauthorized actions or disclose sensitive information. The CVSS score of 6.5 indicates a medium severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users should monitor vendor communications for updates and apply patches once available.