Red HatCVE-2026-93566
Red Hat Netty. A remote attacker: request smuggling
No fix yet
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Build of Debezium 3.6 Product | all versions | No fix yet |
| Red Hat JBoss Enterprise Application Platform 8.1 Product | all versions | No fix yet |
| Red Hat build of Keycloak 26.4.17 Product | all versions | No fix yet |
| Red Hat build of Keycloak 26.6.8 Product | all versions | No fix yet |
| Red Hat build of Quarkus 3.27.5.SP2 Product | all versions | No fix yet |
| Red Hat build of Quarkus 3.33.3.SP2 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-1035
- www.cve.org/CVERecord?id=CVE-2026-93566
- nvd.nist.gov/vuln/detail/CVE-2026-93566
- access.redhat.com/errata/RHSA-2026:69440
- access.redhat.com/errata/RHSA-2026:69470
- access.redhat.com/errata/RHSA-2026:83612
- access.redhat.com/errata/RHSA-2026:95759
- access.redhat.com/errata/RHSA-2026:95760
- access.redhat.com/errata/RHSA-2026:95761
- access.redhat.com/errata/RHSA-2026:95762
- access.redhat.com/errata/RHSA-2026:95887
- access.redhat.com/security/cve/CVE-2026-93566
- bugzilla.redhat.com/show_bug.cgi?id=2536954