CVE-2026-93579 describes a flaw in Netty's HTTP/2 implementation where insufficient validation of HTTP/2 header field values permits injection of prohibited characters such as NUL, Line Feed, and Carriage Return. This vulnerability can be exploited when headers are translated from HTTP/2 to HTTP/1.1, enabling attacks like request smuggling, header injection, or response splitting. These attacks may result in unauthorized access or manipulation of data by bypassing security controls.

The vulnerability allows remote attackers to manipulate HTTP headers by injecting prohibited characters, which can lead to request smuggling, header injection, or response splitting attacks. These attacks may cause unauthorized access to resources, data manipulation, or other security bypasses. The CVSS score of 6.5 (medium severity) reflects the potential for confidentiality and integrity impacts without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix or patch links, users should monitor vendor communications for updates. Until a fix is available, consider mitigating risks by restricting exposure of vulnerable Netty HTTP/2 services and applying any recommended configuration changes from the vendor.