CVE-2026-93562 Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
Remote attackers can perform HTTP request smuggling via malformed Transfer-Encoding headers, bypassing security controls and accessing unauthorized resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93562?
CVE-2026-93562 is a medium-severity vulnerability in Red Hat AMQ Broker 7, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
Weakness: CWE-1035
Which versions are affected by CVE-2026-93562?
How do I fix CVE-2026-93562?
Upgrade to a fixed version.
Is CVE-2026-93562 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93562 exists.
Sources
Also known as DEBIAN-CVE-2026-93562, GHSA-c599-gp9v-cp79, UBUNTU-CVE-2026-93562.