CVE-2026-93562: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-93562 is an HTTP request smuggling vulnerability in Netty's HTTP/1 decoder caused by incomplete validation of malformed Transfer-Encoding headers. It affects io.netty:netty-codec-http versions up to and including 4.1.137.Final and 4.2.0.Final through 4.2.17.Final. The vulnerability was disclosed on September 18, 2026, and is tracked under GitHub Advisory GHSA-c599-gp9v-cp79. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause lies in io.netty.handler.codec.http.HttpObjectDecoder#readHeaders, which uses two inconsistent checks to determine whether chunked is the final transfer coding. HttpUtil.isTransferEncodingChunked() detects the chunked token anywhere in any Transfer-Encoding field, while a separate suffix check tests only whether the last raw field value ends with the string chunked — not whether it is the final parsed token. This allows malformed headers such as multi-line Transfer-Encoding: chunked / Transfer-Encoding: gzip (semantically equivalent to chunked, gzip) or Transfer-Encoding: chunked, xchunked to be incorrectly accepted and decoded as chunked, violating RFC 9112. This is described as an incomplete fix/bypass of CVE-2026-42585 (GHSA-38f8-5428-x5cv). A proof-of-concept reproducer (TransferEncodingSmugglingReproducer.java) and a patch file were attached to the Red Hat Bugzilla report (Red Hat Bugzilla, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to inject arbitrary HTTP requests into the request stream processed by a backend server, a technique known as HTTP request smuggling. This can result in bypassing security controls (e.g., WAF rules, authentication checks), accessing unauthorized resources, poisoning shared caches, or hijacking other users' requests in parser-differential deployments. Confidentiality and integrity are both assessed as low impact, with no direct availability impact (GitHub Advisory, Red Hat Bugzilla).

As of the disclosure date, there is no evidence of active in-the-wild exploitation and no public proof-of-concept exploit kit, though a reproducer Java file was shared within the Red Hat Bugzilla report. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Red Hat Bugzilla).

1. Identify target: Locate services using io.netty:netty-codec-http versions ≤4.1.137.Final or 4.2.0.Final–4.2.17.Final deployed behind a reverse proxy or load balancer in a parser-differential configuration.
2. Craft malformed Transfer-Encoding headers: Construct an HTTP/1.1 request with headers that pass Netty's suffix check but violate RFC 9112 — for example, two separate Transfer-Encoding header lines (Transfer-Encoding: chunked followed by Transfer-Encoding: gzip), or a single value like Transfer-Encoding: chunked, xchunked.
3. Send the smuggling request: Transmit the crafted request to the Netty-based frontend or backend. Netty incorrectly decodes the body as chunked while the upstream proxy may interpret it differently, creating a desynchronization.
4. Inject arbitrary HTTP request: Embed a second, hidden HTTP request within the body of the first. Due to the parser desynchronization, the backend processes the injected request as a new, independent request — potentially targeting internal endpoints, bypassing authentication, or poisoning shared state (Red Hat Bugzilla).

• Network: HTTP/1.1 requests containing multiple Transfer-Encoding header lines (e.g., Transfer-Encoding: chunked and Transfer-Encoding: gzip as separate headers) or values like Transfer-Encoding: chunked, xchunked directed at Netty-based services.
• Logs: Unexpected or malformed requests appearing in backend access logs that do not correspond to any request logged by the frontend proxy; requests to internal-only endpoints originating from the Netty service account or proxy IP.
• Application Behavior: Unexplained access to restricted resources or authentication bypass events correlated with unusual Transfer-Encoding header patterns in access logs (Red Hat Bugzilla).

Update io.netty:netty-codec-http to a patched version once available (fixed versions were not yet specified at time of disclosure for either the 4.1.x or 4.2.x branches). As interim mitigations: implement strict server-side validation of Transfer-Encoding headers to reject any request where chunked is not the sole and final transfer coding; deploy a Web Application Firewall (WAF) configured to detect and block malformed Transfer-Encoding headers and HTTP request smuggling patterns; and review security controls that could be bypassed via request smuggling. Monitor the Netty GitHub Security Advisory (GHSA-hcvj-94mj-jp5c) for fixed version announcements (GitHub Advisory, Red Hat Bugzilla).

Red Hat assigned this CVE and opened a Bugzilla tracking issue (Bug 2536951) with 66 CC'd users, indicating broad internal concern across Red Hat product teams. The vulnerability was noted as an incomplete fix/bypass of a prior Netty smuggling issue (CVE-2026-42585), which may draw additional scrutiny from the security community. No notable public researcher commentary or significant media coverage was identified at the time of disclosure (Red Hat Bugzilla).