CVE-2026-93567 is a flaw in Netty's HTTP/2 codec where the conversion of HTTP/1 CONNECT requests to HTTP/2 incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by providing a different Host header, causing the HTTP/2 CONNECT request to have an attacker-controlled authority. This bypasses security controls such as tunnel allow-lists and egress policies, potentially allowing connections to unintended upstream targets and resulting in integrity loss. The issue affects multiple specific Netty versions as listed, and Red Hat products configured as HTTP/1-to-HTTP/2 proxies or gateways are impacted. The CVSS v3.1 score is 7.5 (medium severity) with an integrity impact but no confidentiality or availability impact. No known exploits in the wild have been reported. Mitigation guidance and fixed versions are available from the Netty GitHub security advisory.

The vulnerability allows remote attackers to bypass security controls like tunnel allow-lists and egress policies by manipulating the Host header in HTTP/1 CONNECT requests. This leads to malformed HTTP/2 CONNECT requests with attacker-controlled authority, resulting in integrity loss. There is no direct confidentiality or availability impact reported. The flaw affects the integrity of proxy or gateway configurations that convert HTTP/1 to HTTP/2.

Fixed versions and remediation guidance are available from the Netty GitHub security advisory (https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg). Users should upgrade to fixed versions of Netty as indicated in the advisory. Red Hat customers should monitor Red Hat advisories for patches relevant to their products. No vendor advisory states that no action is required; therefore, upgrading to a fixed version is recommended to mitigate this vulnerability.