Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-93569 HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority https://www.cve.org/CVERecord?id=CVE-2026-93569
Post summary
The text serves as a disclosure announcement for CVE-2026-93569, detailing a specific HTTP/1 to HTTP/2 translation vulnerability where a Host header mismatch overrides the request-target authority, and links to the official CVE record.