EUVD-2026-82943
GHSA-xf8w-rc87-x5gw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Smuggling/authority-confusion needs a specific H1→H2 translation topology and downstream desync (AC:H) and affects a separate backend system (S:C); pure integrity impact, so C:N/A:N.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
4DescriptionCVE.org
HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority
Articles & Coverage 1
AnalysisAI
Malformed HTTP/2 CONNECT stream injection in Red Hat JBoss EAP and the wider Red Hat middleware stack (Quarkus, Keycloak, Camel for Spring Boot 4 and Quarkus 3, Data Grid 8, AMQ Broker 7, Fuse 7, Apicurio Registry 3, Debezium 3) lets unauthenticated remote attackers control the :authority of an upstream HTTP/2 CONNECT when the product is deployed as an HTTP/1-to-HTTP/2 translating proxy or gateway. The client-supplied Host header from an HTTP/1 authority-form CONNECT is copied verbatim into the HTTP/2 :authority pseudo-header, so the fronting component and the HTTP/2 backend can disagree about the routing target, yielding an integrity impact (vendor CVSS 3.1 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; our assessment raises the attack complexity to High and the scope to Changed because a H1→H2 CONNECT translation path and a fronting-proxy topology are required). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to operate as an HTTP/1-to-HTTP/2 translating proxy/gateway that accepts authority-form CONNECT requests and forwards them onto an HTTP/2 upstream - that translation path is the exact trigger, since the flaw is the client Host being copied verbatim into the HTTP/2 :authority pseudo-header. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Vendor scores this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) - a pure-integrity flaw with network vector and no privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the supplied data, so treat this as unpatched at time of analysis and monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-93567 plus Bugzilla 2536955 (https://bugzilla.redhat.com/show_bug.cgi?id=2536955) for the fixed RPM/container image versions and apply them as soon as they are published - Red Hat typically ships these as errata for each affected stream (JBoss EAP 7/8, Data Grid 8, AMQ Broker 7, Fuse 7, Keycloak, Quarkus, Camel, Apicurio Registry, Debezium). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of Red Hat JBoss EAP, Quarkus, Keycloak, Camel for Spring Boot 4 and Quarkus 3, Data Grid 8, AMQ Broker 7, Fuse 7, Apicurio Registry 3, and Debezium 3, focusing on instances configured as HTTP/1-to-HTTP/2 translating proxies or gateways; restrict network access to these components and disable HTTP/2 CONNECT support where not required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today