CVE-2026-93568

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A flaw exists where the HTTP-object conversion path incorrectly processes specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests as regular HTTP/1.1 CONNECT requests. This misinterpretation leads to a loss of critical protocol and path information, which can allow remote attackers to bypass security policies, such as authorization logic or routing, in applications utilizing Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.