This vulnerability arises from a flaw in Netty's HTTP/1 decoder used by Red Hat AMQ Broker 7, where incomplete validation of malformed Transfer-Encoding headers enables HTTP request smuggling attacks. An attacker can exploit this by crafting HTTP requests that inject arbitrary HTTP requests, which may bypass security controls or access unauthorized resources. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact without availability impact.

Successful exploitation can allow an attacker to inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources. The impact includes limited confidentiality and integrity compromise but no impact on availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93562 for current remediation guidance. No official fix or patch information is provided in the available data.