CVE-2026-93567

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A flaw exists in the HTTP/2 codec when converting HTTP/1 CONNECT requests to HTTP/2. The component incorrectly utilizes the Host header instead of the CONNECT authority-form request-target to determine the tunnel authority. A remote attacker can provide a conflicting Host header to generate a malformed HTTP/2 CONNECT request, potentially bypassing security controls such as egress policies or tunnel allow-lists, which leads to integrity loss.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.