{"id":"CVE-2026-93569","published":"2026-09-18T15:17:20.743","lastModified":"2026-09-22T19:16:58.477","description":"A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.","cvssScore":8.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","cwes":["CWE-444"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:69440","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:69470","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:70257","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93569","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536962","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}