CVE-2026-93569 describes an HTTP request smuggling vulnerability in Red Hat AMQ Broker 7 where an HTTP/1 absolute-form Host mismatch is incorrectly translated to the HTTP/2 :authority header, overriding the intended request-target authority. This inconsistent interpretation can be exploited to bypass security controls, poison web caches, or leak client credentials. The vulnerability is tracked under CWE-444 (Inconsistent Interpretation of HTTP Requests). Red Hat's advisory points to a related fix in the Netty project (netty-codec-http2) and provides guidance via the Netty security advisory. However, Red Hat does not explicitly confirm fixed versions or patch availability for AMQ Broker 7 in the advisory. The CVSS 3.1 base score is 8.2 (high severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and no availability impact.

The vulnerability allows an attacker to craft HTTP messages that exploit inconsistent HTTP request parsing, potentially enabling web cache poisoning, firewall bypass, unauthorized access to web applications, and leakage of client credentials. The integrity of the affected system can be compromised, but availability is not impacted. Confidentiality impact is low. There are no known exploits in the wild at this time.

Red Hat's advisory references the Netty project's security advisory (https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m) for fixed versions and remediation guidance. Users of Red Hat AMQ Broker 7 should consult this advisory and Red Hat's official security page (https://access.redhat.com/security/cve/CVE-2026-93569) for updates on patch availability. Since no explicit patch or fixed version is stated for AMQ Broker 7, patch status is not yet confirmed. Users should monitor vendor advisories for official fixes and apply them when available. No vendor advisory states that no action is required or that the issue is already mitigated.