Red Hat Quarkus CVE-2026-93569

Exploitation requires a deployment where the affected component translates HTTP/1 requests into HTTP/2 (a reverse proxy, gateway, or protocol-bridging listener fronting HTTP/2 backends), and the attacker must send an HTTP/1 request whose absolute-form request-target authority deliberately differs from the Host header. Realistic impact further depends on a downstream service that routes or enforces authorization on the HTTP/2 :authority pseudo-header. Limiting factors: the vulnerable HTTP/1-to-HTTP/2 translation path must actually be in use (not a default for every listed product), and classic request-smuggling exploitation typically needs a specific proxy/backend desync topology, which raises real-world complexity above the vendor's AC:L rating.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 8.2 High) describes a remote, unauthenticated, low-complexity request-smuggling flaw (CWE-444) whose dominant impact is integrity (I:H) with limited confidentiality exposure (C:L) and no availability effect. There is no EPSS score, no CISA KEV listing, and no public exploit code in the provided data, so this is 'no public exploit identified at time of analysis' - a design/correctness flaw discovered and reported by Red Hat rather than an actively-exploited threat. No SSVC decision data was supplied. The high base score is driven by the unauthenticated network vector plus the I:H rating for authority confusion; in practice, real-world exploitability is gated by deployment topology (the affected component must translate HTTP/1 to HTTP/2, i.e. act as a fronting proxy/gateway), which is not reflected in the AC:L rating - a fronting-proxy desync arguably warrants AC:H and the smuggling could justify S:C. Treat as a genuine hardening priority for exposed HTTP/2-terminating gateways, but not an emergency absent exploitation signals.

An attacker sends a crafted HTTP/1 request using an absolute-form request target whose authority disagrees with the Host header; the affected component translates this to the HTTP/2 :authority pseudo-header, overriding the intended request-target authority. A downstream service that routes or enforces access control on :authority can then be tricked into serving or forwarding the request to an attacker-chosen authority, enabling request smuggling and access-control bypass. No public exploit code was identified in the provided sources.