--- title: "CVE-2026-93568: CVE-2026-93568" description: "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss." url: https://panop.io/threat-heartbeat/CVE-2026-93568/ --- # CVE-2026-93568 CVE-2026-93568 A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss. CVSS base score 7.5 /10 High CISA KEV Not listed Public exploit None known EPSS 0.89% chance of exploitation in 30 days [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-93568) ## Details CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Published 18 September 2026 Updated 15 October 2026 Weakness [CWE-20](https://cwe.mitre.org/data/definitions/20.html) ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-93568](https://nvd.nist.gov/vuln/detail/CVE-2026-93568) - [https://access.redhat.com/security/cve/CVE-2026-93568](https://access.redhat.com/security/cve/CVE-2026-93568) - [https://bugzilla.redhat.com/show\_bug.cgi?id=2536961](https://bugzilla.redhat.com/show_bug.cgi?id=2536961) - [https://access.redhat.com/errata/RHSA-2026:69470](https://access.redhat.com/errata/RHSA-2026:69470) - [https://access.redhat.com/errata/RHSA-2026:69440](https://access.redhat.com/errata/RHSA-2026:69440) - [https://access.redhat.com/errata/RHSA-2026:70257](https://access.redhat.com/errata/RHSA-2026:70257) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)