Netty's HTTP-object conversion path incorrectly downgrades HTTP/2 and HTTP/3 Extended CONNECT requests to standard HTTP/1.1 CONNECT requests. This misinterpretation causes loss of critical protocol and path information, enabling attackers to bypass security policies such as routing or authorization logic in applications that use Netty for HTTP/2 or HTTP/3 communication. The flaw impacts integrity by allowing unauthorized actions. The vulnerability is identified as CVE-2026-93568 with a CVSS v3.1 score of 7.5. Red Hat advisory confirms this issue affects multiple Netty versions and provides links to fixed versions and remediation guidance.

The vulnerability allows remote attackers to bypass security policies, including routing and authorization, due to improper handling of Extended CONNECT requests. This leads to integrity loss in affected applications. There is no direct confidentiality or availability impact reported. The flaw can cause applications acting as gateways, proxies, or servers using Netty to improperly enforce security policies.

A fix is available. Refer to the official Red Hat advisory and Netty's GitHub security advisories (https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f) for fixed versions and remediation guidance. Users should upgrade to patched versions of Netty to address this vulnerability. No vendor advisory states that no action is required or that the issue is already mitigated without patching.