CVE-2026-93579 PUBLISHED

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Assigner: redhat
Reserved: 18.09.2026 Published: 18.09.2026 Updated: 18.09.2026

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 6.5

Product Status

Vendor Red Hat
Product Red Hat AMQ Broker 7
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Apache Camel 4 for Quarkus 3
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Apache Camel for Spring Boot 4
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Apicurio Registry 3
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Debezium 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: unknown
Vendor Red Hat
Product Red Hat build of Quarkus
Versions Default: affected
Vendor Red Hat
Product Red Hat Data Grid 8
Versions Default: unknown
Vendor Red Hat
Product Red Hat Fuse 7
Versions Default: unknown
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: unknown
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Single Sign-On 7
Versions Default: unknown

Workarounds

See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance.

References

Problem Types

  • CWE-1035 CWE