EUVD-2026-82945
GHSA-xx86-5ch4-942v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Remote unauthenticated authority confusion yields I:H (smuggling/authz bypass) with incidental C:L; S:C is defensible but I retain vendor S:U, and AC:H is arguable given required proxy topology.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority
Articles & Coverage 1
AnalysisAI
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat middleware lets a remote, unauthenticated attacker smuggle requests across the HTTP/1-to-HTTP/2 protocol boundary, overriding the :authority pseudo-header that downstream services use for routing and authorization. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 8.2 High) rates integrity as the dominant impact (I:H) with limited confidentiality exposure (C:L) and no availability effect, consistent with a CWE-444 request-smuggling class defect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a deployment where the affected component translates HTTP/1 requests into HTTP/2 (a reverse proxy, gateway, or protocol-bridging listener fronting HTTP/2 backends), and the attacker must send an HTTP/1 request whose absolute-form request-target authority deliberately differs from the Host header. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 8.2 High) describes a remote, unauthenticated, low-complexity request-smuggling flaw (CWE-444) whose dominant impact is integrity (I:H) with limited confidentiality exposure (C:L) and no availability effect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the provided intelligence; the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93569 and Bugzilla 2536962 should be monitored for fix errata, and updates should be applied across every listed product that terminates HTTP/1 or bridges to HTTP/2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Red Hat build of Quarkus and other affected Red Hat middleware deployment, especially any gateway, proxy, or service mesh that translates HTTP/1 requests into HTTP/2; because no vendor-released patch identified at time of analysis, disable HTTP/1-to-HTTP/2 translation or absolute-form request handling where feasible, enforce HTTP/2 end-to-end, reject absolute-form request targets at the edge, and configure downstream services to ignore client-supplied :authority for routing and authorization. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today