CVE-2026-93579: Netty HTTP/2 Header Injection Vulnerability

CVE-2026-93579 Overview

CVE-2026-93579 is a header injection vulnerability in Netty's HTTP/2 stack. The flaw allows remote attackers to inject prohibited characters, including NUL, Line Feed (LF), and Carriage Return (CR), into HTTP/2 header field values. Insufficient input validation permits these characters to survive translation from HTTP/2 to HTTP/1.1. Downstream systems then interpret the smuggled bytes as protocol control data. Attackers can leverage this behavior for HTTP request smuggling, header injection, and response splitting attacks. The weakness is classified under [CWE-1035] and impacts Netty deployments used in gateways, reverse proxies, and application servers.

Critical Impact
Remote unauthenticated attackers can smuggle HTTP requests across protocol translation boundaries, enabling access control bypass, cache poisoning, and unauthorized data disclosure.

Affected Products

Netty HTTP/2 implementations affected by the disclosed advisories
Red Hat products referenced in RHSA-2026:69440
Red Hat products referenced in RHSA-2026:69470

Discovery Timeline

2026-09-18 - CVE-2026-93579 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-93579

Vulnerability Analysis

The vulnerability resides in Netty's HTTP/2 header parsing logic. HTTP/2 transmits headers using a binary encoding (HPACK), which permits certain byte values that HTTP/1.1 treats as framing delimiters. Netty fails to reject prohibited control characters, including 0x00 (NUL), 0x0A (LF), and 0x0D (CR), inside header field values.

When a Netty-based proxy or gateway translates HTTP/2 traffic into HTTP/1.1 for a backend origin, the injected bytes emerge as literal characters in the outbound request. HTTP/1.1 parsers interpret CRLF sequences as header terminators, allowing an attacker to append forged headers or an entirely new request. The same primitive supports response splitting when responses cross the translation boundary in the opposite direction.

Root Cause

The root cause is missing character-set validation on HTTP/2 header values before encoding them into HTTP/1.1 wire format. RFC 9113 requires HTTP/2 endpoints to treat CR, LF, and NUL in field values as malformed and to reject such messages. Netty's translation layer processed these values without enforcing the required constraint.

Attack Vector

An unauthenticated remote attacker submits a crafted HTTP/2 request containing control characters within a header value. When the request traverses a Netty component that downgrades HTTP/2 to HTTP/1.1, the injected bytes are written verbatim to the backend socket. The backend then parses the smuggled content as additional headers or a second request. See the Red Hat CVE Analysis for CVE-2026-93579 for further technical detail.

No verified proof-of-concept code is available at this time; refer to the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-93579

Indicators of Compromise

HTTP/2 requests containing 0x00, 0x0A, or 0x0D bytes within header field values
Unexpected duplicate Host, Content-Length, or Transfer-Encoding headers observed at backend origins
Backend access logs recording requests that were not proxied by the front-end gateway
Anomalous response splitting patterns or cache entries containing attacker-controlled headers

Detection Strategies

Inspect HTTP/2 traffic at the edge and drop frames whose header values contain prohibited control characters
Correlate front-end proxy logs against backend origin logs to identify request count mismatches indicative of smuggling
Deploy web application firewall rules that validate header value character sets before forwarding

Monitoring Recommendations

Enable verbose logging on Netty-based proxies to capture rejected or malformed HTTP/2 frames
Monitor backend origins for parser errors, unexpected pipelined requests, or protocol violations
Alert on any HTTP/1.1 request emitted by an HTTP/2 gateway that contains a header value with embedded CRLF sequences

How to Mitigate CVE-2026-93579

Immediate Actions Required

Identify all applications and middleware that embed Netty as an HTTP/2 endpoint or translation proxy
Apply vendor patches referenced in RHSA-2026:69440 and RHSA-2026:69470
Restart affected services after patching to ensure updated Netty classes are loaded
Audit reverse proxies and API gateways for exposure to untrusted HTTP/2 clients

Patch Information

Red Hat has published fixed packages in RHSA-2026:69440 and RHSA-2026:69470. Additional analysis is available in the Red Hat CVE record for CVE-2026-93579 and Red Hat Bugzilla #2536970. Upgrade Netty to the fixed version distributed with these advisories.

Workarounds

Terminate HTTP/2 at a validated front-end and forward only sanitized HTTP/1.1 traffic to backends
Deploy WAF or reverse proxy rules that reject header values containing NUL, CR, or LF bytes
Disable HTTP/2-to-HTTP/1.1 downgrade paths where they are not operationally required
Restrict exposure of Netty-based HTTP/2 listeners to trusted networks pending patch deployment

bash

# Example WAF rule concept: reject HTTP/2 headers containing control characters
# ModSecurity example
SecRule REQUEST_HEADERS "@rx [\\x00\\x0a\\x0d]" \
    "id:1029357,phase:1,deny,status:400,msg:'HTTP/2 header injection attempt (CVE-2026-93579)'"