The vulnerability CVE-2026-93573 arises from Netty's improper handling of split Transfer-Encoding HTTP headers, which bypasses final-chunked validation and enables HTTP request smuggling attacks. This can cause inconsistent interpretation of HTTP requests, potentially allowing attackers to poison web caches, bypass firewall protections, or retrieve client credentials. The issue is tracked in Red Hat AMQ Broker 7, with Red Hat advising users to refer to the Netty security advisory GHSA-3jrc-fchc-59pw for fixed versions and remediation guidance. No explicit affected versions or direct patches from Red Hat are provided in the advisory.

An attacker can exploit this vulnerability to perform HTTP request smuggling, which may lead to web cache poisoning, firewall bypass, and unauthorized access to web applications. The CVSS v3.1 score is 6.5 (medium), reflecting low confidentiality and integrity impacts without availability impact. The vulnerability requires no privileges or user interaction and can be exploited remotely over the network.

Red Hat directs users to the Netty security advisory (https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw) for fixed versions and remediation guidance. Users should apply the fixes provided by Netty to address the vulnerability. No direct Red Hat patch or fix is currently specified. Users should monitor Red Hat advisories for updates and consider upgrading to versions of Netty that include the fix. No additional mitigation steps are documented by Red Hat at this time.