CVE-2026-93573 is a vulnerability in Netty's HTTP/1.1 decoder where an attacker can bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This improper handling allows HTTP request smuggling attacks, which can bypass front-end security controls or cause desynchronization in request processing when Netty is deployed with intermediaries interpreting these headers differently. The vulnerability affects numerous specific Netty versions as listed. Red Hat advisory references fixed versions and remediation guidance available at the Netty GitHub security advisories.

The vulnerability allows remote attackers to perform HTTP request smuggling by exploiting inconsistent interpretation of split Transfer-Encoding headers. This can lead to bypassing security controls, desynchronizing request processing, and requests being processed in unintended contexts. The confidentiality and integrity impacts are low, with no availability impact. The CVSS 3.1 base score is 6.5, indicating medium severity.

A fix is available. Users should consult the Netty GitHub security advisories at https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw for fixed versions and remediation guidance. Red Hat customers should refer to the Red Hat advisory for updates and patches. Applying the official patches or upgrading to fixed versions is the recommended mitigation.