CVE-2026-93566 - Vulnerability Details

- Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

Description

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

Published: 2026-09-18

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor	Product	Default status	Versions
Red Hat	Red Hat AMQ Broker 7	affected	—
Red Hat	Red Hat AMQ Clients	affected	—
Red Hat	Red Hat build of Apache Camel 4 for Quarkus 3	affected	—
Red Hat	Red Hat build of Apache Camel for Spring Boot 4	affected	—
Red Hat	Red Hat build of Apicurio Registry 3	unknown	—
Red Hat	Red Hat build of Debezium 3	affected	—
Red Hat	Red Hat Build of Keycloak	unknown	—
Red Hat	Red Hat Data Grid 8	unknown	—
Red Hat	Red Hat Fuse 7	unknown	—
Red Hat	Red Hat JBoss Enterprise Application Platform 7	unknown	—
Red Hat	Red Hat JBoss Enterprise Application Platform 8	affected	—
Red Hat	Red Hat Single Sign-On 7	unknown	—

No data.

Vendor Product Confidence Versions

Red Hat

Red Hat Amq Broker 7

100%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Amq Clients

100%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Build Of Apache Camel For Quarkus

86%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Build Of Apache Camel For Spring Boot

89%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Build Of Apicurio Registry

86%

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Redhat

Build Of Debezium 3

85%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Build Of Keycloak

100%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Build Of Quarkus

84%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Data Grid 8

80%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Jboss Enterprise Application Platform

89%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Quay 3

100%

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Single Sign-on

100%

Version	Status	Scheme	Platform
`—`	affected	—	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Workaround

See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00379.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://access.redhat.com/errata/RHSA-2026:69470
https://access.redhat.com/security/cve/CVE-2026-93566
https://bugzilla.redhat.com/show_bug.cgi?id=2536954
https://nvd.nist.gov/vuln/detail/CVE-2026-93566
https://www.cve.org/CVERecord?id=CVE-2026-93566

History

Mon, 21 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Red Hat Red Hat red Hat Amq Broker 7 Redhat build Of Apache Camel For Quarkus Redhat build Of Apache Camel For Spring Boot Redhat build Of Apicurio Registry Redhat build Of Debezium 3 Redhat build Of Keycloak Redhat build Of Quarkus Redhat data Grid 8 Redhat quay 3 Redhat single Sign-on
Vendors & Products		Red Hat Red Hat red Hat Amq Broker 7 Redhat build Of Apache Camel For Quarkus Redhat build Of Apache Camel For Spring Boot Redhat build Of Apicurio Registry Redhat build Of Debezium 3 Redhat build Of Keycloak Redhat build Of Quarkus Redhat data Grid 8 Redhat quay 3 Redhat single Sign-on

Mon, 21 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
CPEs	~~cpe:/a:redhat:quarkus:3~~
Vendors & Products	Redhat quarkus
References		https://access.redhat.com/errata/RHSA-2026:69470

Sat, 19 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-93566 https://www.cve.org/CVERecord?id=CVE-2026-93566
Metrics	threat_severity `None`	threat_severity `Moderate`

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Description	### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch	A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

Fri, 18 Sep 2026 14:30:00 +0000

Type	Values Removed	Values Added
Description		### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch
Title		Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
First Time appeared		Redhat Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On
Weaknesses		CWE-1035
CPEs		cpe:/a:redhat:amq_broker:7 cpe:/a:redhat:amq_clients:2023 cpe:/a:redhat:apicurio_registry:3 cpe:/a:redhat:build_keycloak: cpe:/a:redhat:camel_quarkus:3 cpe:/a:redhat:camel_spring_boot:4 cpe:/a:redhat:debezium:3 cpe:/a:redhat:jboss_data_grid:8 cpe:/a:redhat:jboss_enterprise_application_platform:7 cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_fuse:7 cpe:/a:redhat:quarkus:3 cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products		Redhat Redhat amq Broker Redhat amq Clients Redhat apicurio Registry Redhat build Keycloak Redhat camel Quarkus Redhat camel Spring Boot Redhat debezium Redhat jboss Data Grid Redhat jboss Enterprise Application Platform Redhat jboss Fuse Redhat quarkus Redhat red Hat Single Sign On
References		https://access.redhat.com/security/cve/CVE-2026-93566 https://bugzilla.redhat.com/show_bug.cgi?id=2536954
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}`

Subscriptions

Red Hat Red Hat Amq Broker 7

Redhat Amq Broker Amq Clients Apicurio Registry Build Keycloak Build Of Apache Camel For Quarkus Build Of Apache Camel For Spring Boot Build Of Apicurio Registry Build Of Debezium 3 Build Of Keycloak Build Of Quarkus Camel Quarkus Camel Spring Boot Data Grid 8 Debezium Jboss Data Grid Jboss Enterprise Application Platform Jboss Fuse Quay 3 Red Hat Single Sign On Single Sign-on

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2026-09-18T14:19:29.741Z

Updated: 2026-09-21T17:24:31.105Z

Reserved: 2026-09-18T10:00:52.431Z

Link: CVE-2026-93566

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-09-18T15:17:20.290

Modified: 2026-09-21T18:17:16.527

Link: CVE-2026-93566

Redhat

Severity : Moderate

Publid Date: 2026-09-10T00:47:37Z

Links: CVE-2026-93566 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T19:25:31Z

Weaknesses

CWE-1035

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object