CVE-2026-93567: Netty HTTP/2 Auth Bypass Vulnerability

CVE-2026-93567 Overview

A flaw was found in Netty's HTTP/2 codec when converting HTTP/1 CONNECT requests to HTTP/2. The component incorrectly uses the Host header instead of the CONNECT authority-form request-target when constructing the tunnel authority. A remote attacker can supply a mismatched Host header to produce a malformed HTTP/2 CONNECT request. The mismatch can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss. The weakness is tracked as improper input validation [CWE-20].

Critical Impact
Attackers can bypass tunnel allow-lists and egress filtering by crafting HTTP/1 CONNECT requests with a divergent Host header, breaking the integrity of proxy authorization decisions.

Affected Products

Netty HTTP/2 codec (io.netty:netty-codec-http2)
Red Hat products shipping the affected Netty component (see Red Hat Security Advisories)
Applications and proxies that translate HTTP/1 CONNECT requests into HTTP/2

Discovery Timeline

2026-09-18 - CVE-2026-93567 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93567

Vulnerability Analysis

HTTP/1 CONNECT requests use an authority-form request-target (for example, example.com:443) to identify the tunnel destination. HTTP/2 conveys the same information in the :authority pseudo-header. When Netty's HTTP/2 codec translates an inbound HTTP/1 CONNECT request to HTTP/2, it should copy the authority-form target into :authority. Instead, the codec reads the Host header. An attacker who controls both fields can point the tunnel at one destination while presenting a different Host header to any upstream authorization logic. Because HTTP/2 intermediaries and downstream services rely on :authority for routing and policy decisions, the resulting request is malformed and violates the trust boundary between the HTTP/1 edge and the HTTP/2 backend. The weakness affects confidentiality boundaries indirectly but primarily damages request integrity.

Root Cause

The HTTP/1-to-HTTP/2 translation logic selects the wrong source field when populating the HTTP/2 :authority pseudo-header for CONNECT methods. RFC 7230 and RFC 7540 require that the authority-form request-target take precedence for CONNECT. Substituting the Host header is an input validation failure classified under [CWE-20].

Attack Vector

The attack is remote and unauthenticated. An attacker sends an HTTP/1 request such as CONNECT internal-service:8080 HTTP/1.1 with a Host: allowed.example.com header. A Netty-based proxy or gateway that upgrades the request to HTTP/2 emits a :authority derived from Host, so allow-list checks evaluate the benign hostname while the tunnel targets internal-service:8080. This enables egress policy bypass, cross-tenant tunneling, and access to restricted internal endpoints. Refer to the Red Hat CVE Report for CVE-2026-93567 for additional technical context.

// No verified proof-of-concept code is published for this CVE.
// See Red Hat's advisory for technical details on the CONNECT authority handling flaw.

Detection Methods for CVE-2026-93567

Indicators of Compromise

HTTP/1 CONNECT requests where the authority-form request-target does not match the Host header value.
HTTP/2 CONNECT frames whose :authority pseudo-header resolves to hosts outside the configured tunnel allow-list.
Unexpected outbound tunnel connections from Netty-based proxies to internal IP ranges or non-approved ports.

Detection Strategies

Inspect proxy access logs for CONNECT methods and compare the request-target against the Host header on every hop.
Add signatures to web application firewalls or service meshes that reject CONNECT requests when the two authorities diverge.
Correlate proxy egress logs with egress firewall telemetry to identify tunnels whose destinations were never authorized at the HTTP layer.

Monitoring Recommendations

Enable structured logging of HTTP/2 :authority values on all Netty-based ingress and egress components.
Alert on new destination authorities appearing in tunnel logs that were not present in the previous baseline window.
Track error rates and 4xx responses on internal services that should never receive external CONNECT traffic.

How to Mitigate CVE-2026-93567

Immediate Actions Required

Inventory all applications and proxies that embed Netty's HTTP/2 codec (io.netty:netty-codec-http2).
Apply the fixed Netty release referenced by the Red Hat Security Advisory RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257.
Restart affected services after upgrading dependent libraries to load the patched codec.

Patch Information

Red Hat has published errata addressing CVE-2026-93567 across affected product streams. Consult RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257 for the exact fixed package versions. Downstream projects that bundle Netty should update their transitive dependency and rebuild. Additional context is available in Red Hat Bug Report #2536955.

Workarounds

Disable HTTP/1 CONNECT upgrade paths at the ingress layer if the tunnel functionality is not required.
Enforce upstream allow-lists on the authority-form request-target rather than the Host header when terminating HTTP/1 traffic.
Place an HTTP/2-aware egress proxy in front of Netty services to re-validate the :authority pseudo-header against policy.

bash

# Example egress allow-list check using the CONNECT request-target
# Reject requests whose authority-form target differs from the Host header
if [ "$CONNECT_TARGET" != "$HOST_HEADER" ]; then
  echo "Rejecting mismatched CONNECT authority" >&2
  exit 1
fi