A flaw was found in Netty's HTTP/1 decoder. (CVE-2026-93562)
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
AI Analysis
Technical Summary
CVE-2026-93562 describes a vulnerability in Netty's HTTP/1 decoder where incomplete validation of malformed Transfer-Encoding headers enables HTTP request smuggling attacks. An attacker can send specially crafted HTTP requests to inject arbitrary HTTP requests, which may bypass security controls or gain unauthorized access. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No patch or remediation details are available in the provided data.
Potential Impact
The vulnerability allows remote attackers to perform HTTP request smuggling by exploiting incomplete validation of Transfer-Encoding headers. This can lead to bypassing security controls or unauthorized resource access. The impact includes limited confidentiality and integrity loss but no availability impact is indicated.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for updates from the Netty project or vendor. No official fix or workaround is provided in the current data.
A flaw was found in Netty's HTTP/1 decoder. (CVE-2026-93562)
Description
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
CVSS v3.1
Score 6.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-93562 describes a vulnerability in Netty's HTTP/1 decoder where incomplete validation of malformed Transfer-Encoding headers enables HTTP request smuggling attacks. An attacker can send specially crafted HTTP requests to inject arbitrary HTTP requests, which may bypass security controls or gain unauthorized access. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No patch or remediation details are available in the provided data.
Potential Impact
The vulnerability allows remote attackers to perform HTTP request smuggling by exploiting incomplete validation of Transfer-Encoding headers. This can lead to bypassing security controls or unauthorized resource access. The impact includes limited confidentiality and integrity loss but no availability impact is indicated.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for updates from the Netty project or vendor. No official fix or workaround is provided in the current data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-c599-gp9v-cp79
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-93562"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aade4dd55bf5e2cf5ed9def
Added to database: 09/19/2026, 01:26:53 UTC
Last enriched: 09/19/2026, 01:28:59 UTC
Last updated: 09/19/2026, 03:01:24 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.