CVE-2026-93567 is a vulnerability where an HTTP/1 authority-form CONNECT request is improperly translated into a malformed HTTP/2 CONNECT request with a Host-controlled :authority header. This flaw can lead to an authorization bypass due to the malformed request handling. The vulnerability has a high severity rating with a CVSS score of 7.5. A security update addressing this issue is available in Red Hat build of Quarkus 3.33.3.SP2.