Medium severity · published Sep 18, 2026
CVE-2026-93566
Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat AMQ Broker 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat AMQ Clients · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Build of Keycloak · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Data Grid 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Fuse 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Single Sign-On 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apache Camel 4 for Quarkus 3 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apache Camel for Spring Boot 4 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Apicurio Registry 3 · Red Hat
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93566
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-93566
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:69440
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:69470
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:83612
vdb-entry
https://access.redhat.com/security/cve/CVE-2026-93566
issue-tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2536954
More from Red Hat AMQ Broker 7
9.1
CVE-2026-2332
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
8.3
CVE-2026-0603
Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection
8.1
CVE-2026-84218
Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
7.5
CVE-2026-93565
Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
7.5
CVE-2026-93564
Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)
