CVE-2026-93579

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A flaw in the HTTP/2 stack allows a remote attacker to inject prohibited characters, including NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross a translation boundary from HTTP/2 to HTTP/1.1, they can be used for request smuggling, header injection, or response splitting, potentially leading to unauthorized access, data manipulation, or security bypasses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.