CVE-2026-93569 describes a security flaw in Netty's handling of HTTP/1 to HTTP/2 conversion. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty prioritizes the Host header for the HTTP/2 :authority field, ignoring the original request-target authority. This inconsistency can be exploited by remote unauthenticated attackers to bypass security policies in Netty-based HTTP/1 to HTTP/2 proxies or gateways. Potential impacts include unauthorized access, cache poisoning, and unintended request routing. The vulnerability has a CVSS v3.1 score of 8.2 (high severity) with network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact. Red Hat provides advisories and fixed versions linked in their security advisory.

The vulnerability allows remote unauthenticated attackers to bypass security controls in Netty-based proxies or gateways by exploiting inconsistent interpretation of HTTP/1 Host headers and HTTP/2 :authority fields. This can lead to unauthorized access, cache poisoning attacks, and misrouting of requests, potentially compromising host or tenant security boundaries and integrity of web applications relying on Netty for HTTP/2 translation.

Fixed versions and remediation guidance are available as per the Red Hat advisory and Netty's GitHub security advisory (https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m). Users should upgrade to fixed versions of Netty to address this vulnerability. No vendor advisory states that no action is required or that the issue is already mitigated without patching. Patch status is confirmed by the vendor advisory. Users should consult the linked advisories for exact fixed versions and apply updates accordingly.