The vulnerability arises from Netty's netty-codec-http component incorrectly parsing HTTP/1.1 chunk-size tokens that include whitespace after digits. This parsing inconsistency enables HTTP request smuggling attacks, where an attacker can manipulate HTTP requests to bypass security controls or gain unauthorized access in environments using proxies or backend servers. The issue affects Red Hat AMQ Broker 7, which uses this component for HTTP handling.

Exploitation of this vulnerability can allow remote attackers to bypass security controls or access unauthorized resources by leveraging HTTP request smuggling techniques. The impact is limited to integrity and availability, with no direct confidentiality impact reported. The CVSS v3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93574 for current remediation guidance. No explicit patch or workaround information is provided in the available data. Users should monitor the vendor advisory for updates and apply any official fixes once available.