CVE-2026-93568

HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests...

CVE-2026-93568

CVE-2026-93568 affects io.netty/netty-codec-http2 and io.netty/netty-codec-http3 , where HTTP/2 and HTTP/3 Extended CONNECT requests are incorrectly downgraded as regular CONNECT requests. This can lead to a high integrity impact (CVSS 3.1: 7.5 HIGH , vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), ...

EUVD-2026-82977

HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests...

CVE-2026-93568 Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...

CVE-2026-93568

HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests Mitigation See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance...