Red Hat JBoss EAP CVE-2026-93567

Requires the target to operate as an HTTP/1-to-HTTP/2 translating proxy/gateway that accepts authority-form CONNECT requests and forwards them onto an HTTP/2 upstream - that translation path is the exact trigger, since the flaw is the client Host being copied verbatim into the HTTP/2 :authority pseudo-header. No authentication or user interaction is needed (PR:N/UI:N) and it is remotely reachable (AV:N), but deployments that do not perform H1→H2 CONNECT proxying, or that terminate CONNECT without re-emitting HTTP/2, are not exposed. Real-world impact is a routing/smuggling desync against a backend, so a fronting proxy topology is the key limiting precondition.

Vendor scores this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - a pure-integrity flaw with network vector and no privileges. The description places it in the same Netty HTTP codec family as its siblings (Red Hat Bugzilla 2536955 sits immediately adjacent to the STOMP/MQTT/RTSP/HTTP smuggling CVEs 2536952-2536954): when an HTTP/1 authority-form CONNECT is translated to HTTP/2, the :authority pseudo-header is populated from the client-controlled Host, producing a malformed/attacker-influenced HTTP/2 CONNECT - an authority/routing-confusion (request-smuggling-class) weakness, not information disclosure. Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC in the provided references (only access.redhat.com and the Red Hat Bugzilla tracker). No SSVC data is supplied. The AC:L/PR:N vector suggests easy remote reach, but realistic impact depends on a specific deployment: an HTTP/1-to-HTTP/2 translating proxy/gateway sitting in front of an HTTP/2 backend, so the practical attack surface is narrower than the raw 7.5 implies. This is a real integrity issue worth patching for anyone running Netty as an H1→H2 CONNECT proxy, but the absence of EPSS/KEV/POC and the configuration dependency place it below the priority of an actively-exploited flaw. Note the 'Information Disclosure' tag conflicts with the vendor vector (C:N/I:H), so it is mislabeled.

An attacker sends an HTTP/1 authority-form CONNECT request through a Netty-based proxy that downgrades/upgrades to HTTP/2, setting a crafted Host value; the proxy copies it into the HTTP/2 :authority, emitting a malformed CONNECT that can misroute or smuggle the tunnel to an attacker-chosen authority. No authentication is required (PR:N) and complexity is low at the network edge, though a genuine impact requires the target to actually perform H1→H2 CONNECT translation. No public exploit code is identified at time of analysis.