CVE-2026-93569 Security feature bypass in Red Hat AMQ Broker 7
Attackers can bypass security controls in Netty-based proxies by exploiting HTTP/1 to HTTP/2 conversion flaws, leading to unauthorized access or cache poisoning.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93569?
CVE-2026-93569 is a high-severity vulnerability in Red Hat AMQ Broker 7, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
Weakness: CWE-444
Which versions are affected by CVE-2026-93569?
How do I fix CVE-2026-93569?
Upgrade to a fixed version.
Is CVE-2026-93569 being exploited?
There is no known exploitation of CVE-2026-93569 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-93569, GHSA-xx86-5ch4-942v, UBUNTU-CVE-2026-93569.