CVE-2026-93574 is a vulnerability in Netty's netty-codec-http component where the HTTP/1.1 chunk-size token parsing incorrectly accepts post-digit whitespace. This parsing flaw can cause HTTP request smuggling by desynchronizing Netty's interpretation of chunked bodies from other HTTP components in the request path. Exploitation can allow attackers to bypass security controls or gain unauthorized access in proxy/backend environments. The vulnerability is confirmed in multiple specific Netty versions listed in the advisory. Red Hat's advisory references fixed versions and remediation guidance available at the Netty GitHub security advisories.

The vulnerability enables HTTP request smuggling attacks, which can lead to bypassing security controls or unauthorized resource access in proxy or backend deployments using affected Netty versions. The CVSS 3.1 score is 6.5 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Fixed versions and remediation guidance are available from the Netty project at https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc. Users should upgrade to these fixed versions to address the vulnerability. Red Hat's advisory provides additional context and recommends applying updates when available. No vendor advisory states that no action is required or that the issue is already mitigated without patching.