Netty CVE-2026-93579

Exploitation requires a deployment where Netty's HTTP/2 stack accepts inbound HTTP/2 requests and then translates them to HTTP/1.1 for a downstream/backend hop - the injection only becomes smuggling/splitting at that H2-to-H1.1 boundary (e.g., Netty acting as a front proxy or gateway ahead of HTTP/1.1 origins in Quarkus, Keycloak, AMQ Broker, Data Grid, Fuse, EAP, Camel, Apicurio, or Debezium builds). No authentication is required per the vector (PR:N) and no user interaction (UI:N). The key limiting factor is topology: a pure HTTP/2 end-to-end path or a configuration with no HTTP/1.1 translation removes the smuggling/response-splitting impact, reducing this to benign header validation.

This is a real but conditional integrity issue, not a top-tier emergency. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5 Medium) marks it network-reachable and unauthenticated, but the described impact - request smuggling, header injection, and response splitting - only materializes when tainted HTTP/2 header values cross an HTTP/2-to-HTTP/1.1 translation boundary, so a specific proxy/gateway topology is a de facto precondition (arguing for AC:H and a scope change S:C not reflected in the vendor score). No EPSS score, no CISA KEV listing, and no public POC were provided, so the signal set points to no confirmed exploitation. The CWE is listed as CWE-1035, which is a category/view identifier rather than a concrete weakness - the actual weakness is CRLF/header injection (CWE-113/CWE-93) leading to request smuggling (CWE-444). Net: treat as a patch-in-normal-cycle integrity flaw whose real-world exploitability hinges on whether a Netty HTTP/2 front-end feeds an HTTP/1.1 backend; verify that topology before deprioritizing.

An attacker sends an HTTP/2 request to a Netty-based front-end (e.g., a Quarkus, Keycloak, or AMQ endpoint) with NUL, CR, or LF bytes embedded in a header field value. When Netty translates that request to HTTP/1.1 for a backend, the unvalidated control characters split or inject headers, letting the attacker smuggle a second request, poison a response, or bypass an access control. No public exploit code was identified at time of analysis, and the network vector with low complexity makes the injection itself trivial, though a vulnerable H2-to-H1.1 relay must be present.