CVE-2026-93569 Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +35076 more potentially affected by CVE-2026-93569 via io.netty:netty-codec-http2 (>=4.1.0.final, <=4.1.137.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.final, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +6088 more potentially affected by CVE-2026-93569 via io.netty:netty-codec-http2 (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93569 Source advisory: MEND:CVE-2026-93569...

CVE-2026-93569 Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-93567 Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +35076 more potentially affected by CVE-2026-93567 via io.netty:netty-codec-http2 (>=4.1.0.final, <=4.1.137.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.final, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +6088 more potentially affected by CVE-2026-93567 via io.netty:netty-codec-http2 (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93567 Source advisory: MEND:CVE-2026-93567...

CVE-2026-93567 Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

CVE-2026-93567

Io.netty/netty-codec-http2 is vulnerable when an HTTP/1 authority-form CONNECT request is translated into a malformed HTTP/2 CONNECT frame, resulting in a Host-controlled :authority pseudo-header. This is a network-reachable issue requiring no privileges or user interaction, with a CVSS 3.1 base ...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +35107 more potentially affected by CVE-2026-93492 via io.netty:netty-codec-http2 (>=4.1.0.beta4, <=4.1.137.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +6088 more potentially affected by CVE-2026-93492 via io.netty:netty-codec-http2 (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93492 Source advisory: MEND:CVE-2026-93492...

CVE-2026-93492 Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAXHEADERTABLESIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimatel...

CVE-2026-71418: Inefficient Algorithmic Complexity

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer...

Oracle Linux 10 : libsoup3 (ELSA-2026-68235)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68235 advisory. - Fix CVE-2026-85197: http2 crash after connection destroyed - Fix CVE-2026-15711: Reject oversized WebSocket control frames - Fix CVE-2026-15709:...

libsoup3 security update

3.6.5-14 - Fix CVE-2026-85197: http2 crash after connection destroyed 3.6.5-13 - Fix CVE-2026-15711: Reject oversized WebSocket control frames 3.6.5-12 - Fix CVE-2026-15709: bound decompressed WebSocket message size 3.6.5-11 - Add patches for CVE-2026-4271 and CVE-2026-5119 3.6.5-10 - Add patch f...

SUSE SLES15 Security Update : perl-Protocol-HTTP2 (SUSE-SU-2026:4182-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4182-1 advisory. This update for perl-Protocol-HTTP2 fixes the following issue: - CVE-2026-16028: memory exhaustion leading to denial of service due to closed streams...

CVE-2026-83280

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

CVE-2026-83280

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-webserver-http2. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of...

com.akilisha.oss:cafeai-agents (>=0.2.0, <=0.3.2), com.akilisha.oss:cafeai-connect (>=0.1.2, <=0.3.2) +55 more potentially affected by CVE-2026-83280 via io.helidon.webserver:helidon-webserver-http2 (>=4.0.0-m2, <=4.5.4)

io.helidon.webserver:helidon-webserver-http2 MAVEN version =4.0.0-m2, =0.2.0, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.1.2, =0.9.9, =0.9.9, =3.3.1, =3.2.0, =3.3.0 and more Source cves: CVE-2026-83280 Source advisory: MEND:CVE-2026-83280...

io.helidon.webserver.testing.junit5:helidon-webserver-testing-junit5-grpc (27.0.0-m1), io.helidon.webserver.testing.junit5:helidon-webserver-testing-junit5-http2 (27.0.0-m1) +5 more potentially affected by CVE-2026-83280 via io.helidon.webserver:helidon-webserver-http2 (27.0.0-m1)

io.helidon.webserver:helidon-webserver-http2 MAVEN version 27.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.helidon.webserver:helidon-webserver-http2 and may be impacted: -...