CVE-2026-93569: Netty HTTP Conversion Auth Bypass Vulnerability

CVE-2026-93569 Overview

A flaw in the Netty framework allows remote unauthenticated attackers to bypass security controls during HTTP/1 to HTTP/2 protocol conversion. When an HTTP/1 request contains both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header when populating the HTTP/2 :authority pseudo-header. The original request-target authority is discarded, creating an inconsistency between upstream and downstream components. Attackers can exploit this discrepancy to smuggle requests through Netty-based proxies and gateways, enabling unauthorized access, cache poisoning, or request misrouting. The weakness is tracked as CWE-444: Inconsistent Interpretation of HTTP Requests.

Critical Impact

Remote unauthenticated attackers can bypass proxy security controls, poison caches, and misroute HTTP traffic through Netty-based gateways.

Affected Products

• Netty framework (HTTP/1 to HTTP/2 conversion component)
• Red Hat products bundling affected Netty versions (see RHSA-2026:69440)
• Additional Red Hat middleware components addressed in RHSA-2026:69470 and RHSA-2026:70257

Discovery Timeline

• 2026-09-18 - CVE-2026-93569 published to the National Vulnerability Database
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93569

Vulnerability Analysis

The vulnerability resides in Netty's HTTP protocol translation layer, which converts HTTP/1.x requests to HTTP/2 semantics. HTTP/1.1 permits two forms of request-target: origin-form and absolute-form. Absolute-form embeds the authority directly in the request line, for example GET http://backend.internal/admin HTTP/1.1. In HTTP/2, this authority is represented by the :authority pseudo-header.

When Netty encounters a request containing both an absolute-form URI and a Host header with a different value, the converter uses the Host header value for :authority and discards the authority from the request line. Downstream HTTP/2 handlers then route based on the Host value, while upstream HTTP/1 intermediaries may have already made routing or authorization decisions based on the absolute-form target. This desynchronization enables HTTP request smuggling and virtual host confusion attacks.

Root Cause

The root cause is improper reconciliation of conflicting authority sources during protocol translation. RFC 7230 requires that when a request-target contains an authority component, the server must ignore any received Host header. Netty inverts this precedence, violating the specification and creating an inconsistent request view between protocol layers.

Attack Vector

An unauthenticated remote attacker crafts a single HTTP/1 request with an absolute-form URI pointing to one host while setting the Host header to a different, attacker-chosen host. When the request traverses a Netty-based reverse proxy or gateway performing HTTP/1 to HTTP/2 upgrade, the front-end enforces policy on one authority while the back-end services the request under a different authority. This mismatch allows the attacker to reach restricted virtual hosts, poison shared caches with responses keyed to attacker-controlled hosts, or route requests to unintended internal endpoints.

No verified public exploit code has been published. See the Red Hat CVE analysis for technical details.

Detection Methods for CVE-2026-93569

Indicators of Compromise

• HTTP request logs showing absolute-form request-targets combined with a Host header referencing a different authority.
• Access logs revealing successful requests to internal or restricted virtual hosts without corresponding upstream authorization records.
• Cache entries associated with unexpected host keys or content served for hostnames not owned by the origin.

Detection Strategies

• Inspect proxy and application logs for divergence between the request-line URI authority and the Host header value.
• Deploy web application firewall rules that reject or normalize HTTP/1 requests containing conflicting authority sources.
• Correlate front-end and back-end telemetry to surface routing decisions made on different authority values within the same transaction.

Monitoring Recommendations

• Baseline the ratio of absolute-form to origin-form requests and alert on statistically significant increases.
• Monitor Netty version inventory across Java application servers, API gateways, and reverse proxies to identify unpatched instances.
• Enable verbose HTTP/2 frame logging on gateway components during triage to capture :authority values for forensic review.

How to Mitigate CVE-2026-93569

Immediate Actions Required

• Identify all applications and appliances embedding Netty and inventory their HTTP/1 to HTTP/2 conversion configurations.
• Apply vendor patches distributed through the Red Hat advisories RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257.
• Restart affected services after patching to ensure updated protocol handlers are loaded.

Patch Information

Red Hat has released fixed packages for affected products. Consult the Red Hat CVE analysis for CVE-2026-93569 and Bug Report #2536962 for the complete list of updated component versions and remediation guidance. Upstream Netty users should upgrade to the latest release incorporating the corrected authority precedence logic.

Workarounds

• Configure upstream reverse proxies or WAFs to strip absolute-form URIs and rewrite requests to origin-form before forwarding to Netty.
• Reject incoming HTTP/1 requests in which the request-line authority does not match the Host header value.
• Disable HTTP/1 to HTTP/2 protocol conversion where the feature is not required by the application.

# Example WAF rule concept: reject requests with conflicting authority sources
# ModSecurity-style pseudo-configuration
SecRule REQUEST_LINE "@rx ^[A-Z]+\s+https?://([^/\s]+)" \
    "phase:1,chain,deny,status:400,msg:'Conflicting HTTP authority (CVE-2026-93569)'"
    SecRule REQUEST_HEADERS:Host "!@streq %{TX.1}"