The vulnerability exists in the Netty HTTP decoder used by Red Hat AMQ Broker 7, specifically in the method io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions. The method only applies strict validation of chunk size lines if a chunk extension (indicated by a semicolon) is present. If no semicolon is found, the validation is skipped, allowing chunk size lines with embedded bare carriage return characters (e.g., '0\rX') to be accepted. This behavior violates RFC 9112 requirements for chunk-size syntax and enables HTTP request smuggling attacks. A proof-of-concept demonstrates sending a chunked HTTP request with a malformed chunk size line that is accepted by the decoder.

An attacker can exploit this vulnerability to perform HTTP request smuggling against Red Hat AMQ Broker 7 instances using the affected Netty version. This may allow bypassing security controls, request splitting, or other HTTP-level attacks that rely on manipulating chunked transfer encoding parsing. The CVSS score of 6.5 indicates a medium impact with low complexity and no privileges required.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93566 for current remediation guidance. Until an official fix is available, consider applying any recommended temporary mitigations from the vendor advisory. Do not assume the vulnerability is mitigated without vendor confirmation.