CVE-2026-93574 is a medium severity vulnerability in Netty's netty-codec-http component where the HTTP/1.1 chunk-size parser incorrectly accepts post-digit whitespace in chunk-size tokens. This parsing flaw leads to HTTP request smuggling by causing desynchronization between Netty and other HTTP components in the request path. Exploiting this can allow attackers to bypass security controls or gain unauthorized access in proxy/backend deployments. The vulnerability is tracked under CWE-444 (Inconsistent Interpretation of HTTP Requests). Red Hat's advisory references fixed versions and remediation guidance available from the Netty GitHub security advisories.

The vulnerability enables HTTP request smuggling attacks, which can bypass security controls or allow unauthorized access to backend resources in proxy or backend deployments using the affected Netty component. The CVSS v3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and low integrity and availability impacts. There is no confidentiality impact. No known exploits in the wild have been reported.

A fix is available. Users should consult the Netty GitHub security advisory (GHSA-j4mg-hqgv-34qc) for fixed versions and apply updates accordingly. Red Hat's advisory provides additional remediation guidance and references fixed versions. Applying the official patches or upgrading to fixed versions is the recommended mitigation. No vendor advisory states that no action is required or that the issue is already mitigated without patching.