Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / maven/io.netty/netty-all/CVE-2026-93567
Advisory ID gitlab/maven/io.netty/netty-all/CVE-2026-93567
Aliases CVE-2026-93567
GHSA-45h4-vhwh-fmhg
Summary Improper Input Validation A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the `Host` header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different `Host` header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss. The `netty-all` artifact is a shaded jar that embeds the vulnerable `HttpConversionUtil` class up to and including version 4.1.68; from version 4.1.69 onwards it ships no bytecode and is not affected.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-20 Improper Input Validation
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-436 Interpretation Conflict
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/io.netty/netty-all/CVE-2026-93567.yml
Reference id Reference type URL
https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg
CVE-2026-93567 https://nvd.nist.gov/vuln/detail/CVE-2026-93567
show_bug.cgi?id=2536955 Bug https://bugzilla.redhat.com/show_bug.cgi?id=2536955
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/io.netty/netty-all/CVE-2026-93567.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.