AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-93568

Red Hat Netty. A remote attacker: attacker could bypass security policies

Red Hat

CVE-2026-93568 · Published Sep 18, 2026 · updated Nov 6, 2026

High7.5
No fix yet
Red Hat advisory

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.

Affected versions

PackageAffectedFixed in
Red Hat Build of Debezium 3.6
Product
all versionsNo fix yet
Red Hat build of Keycloak 26.4.17
Product
all versionsNo fix yet
Red Hat build of Keycloak 26.6.8
Product
all versionsNo fix yet
Red Hat build of Quarkus 3.27.5.SP2
Product
all versionsNo fix yet
Red Hat build of Quarkus 3.33.3.SP2
Product
all versionsNo fix yet
Details and references

More Red Hat advisories

All Red Hat