CVE-2026-93567

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.

Score
CVSS 3.1 7.5 High
Status
Awaiting Analysis - secalert@redhat.com
Published
2026-09-18
Last modified
2026-10-19
Weaknesses
CWE-20

Affected products

References

 
 
© AVABIS GmbH privacypolicy about