CVE-2026-93574CWE-444

CVE-2026-93574

Medium · published September 19, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
71.4
In the wild
Unconfirmed
What it is

A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01354 · 71.4th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-09-19T01:18Z
References (5)
https://access.redhat.com/errata/RHSA-2026:69440 · [email protected]https://access.redhat.com/errata/RHSA-2026:69470 · [email protected]https://access.redhat.com/errata/RHSA-2026:83612 · [email protected]https://access.redhat.com/security/cve/CVE-2026-93574 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2536966 · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 18 SEP 20:12Z
    Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing
    cvelistv5