CVE-2026-93562

CVE-2026-93562

Medium · published September 19, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00410 · 34.1th percentile
Published
2026-09-19T01:18Z
References (6)
https://access.redhat.com/errata/RHSA-2026:69440 · [email protected]https://access.redhat.com/errata/RHSA-2026:69470 · [email protected]https://access.redhat.com/errata/RHSA-2026:83612 · [email protected]https://access.redhat.com/security/cve/CVE-2026-93562 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2536951 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2536951 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 20:12Z
    Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
    cvelistv5