Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-10T00:55:17 io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough) 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CWE-1035

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.

This Moderate flaw in Netty's HTTP/2 implementation arises from disabled-by-default header value validation. When Netty-based applications act as HTTP/2 to HTTP/1.1 translation proxies or gateways, this can enable request smuggling or response splitting attacks by allowing prohibited control characters to be injected into HTTP/1.1 headers. Pure end-to-end HTTP/2 deployments are not affected. See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance. Red Hat AMQ Broker 7 Fix deferred netty-codec-http2 Red Hat build of Apache Camel 4 for Quarkus 3 Fix deferred netty-codec-http2 Red Hat build of Apache Camel for Spring Boot 4 Fix deferred netty-codec-http2 Red Hat build of Apicurio Registry 3 Fix deferred netty-codec-http2 Red Hat build of Debezium 3 Fix deferred netty-codec-http2 Red Hat Build of Keycloak Out of support scope netty-codec-http2 Red Hat Data Grid 8 Out of support scope netty-codec-http2 Red Hat Fuse 7 Out of support scope netty-codec-http2 Red Hat JBoss Enterprise Application Platform 7 Out of support scope netty-codec-http2 Red Hat JBoss Enterprise Application Platform 8 Fix deferred netty-codec-http2 Red Hat Single Sign-On 7 Out of support scope netty-codec-http2 https://www.cve.org/CVERecord?id=CVE-2026-93579 https://nvd.nist.gov/vuln/detail/CVE-2026-93579