CVE-2026-93569

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description An issue exists in the HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request contains both an absolute-form request-target and a conflicting Host header, the system incorrectly prioritizes the Host header for the HTTP/2 :authority field, which discards the original request-target authority. This inconsistency may allow an unauthenticated remote attacker to bypass security controls in proxies or gateways, potentially resulting in unauthorized access, cache poisoning, or request misrouting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.