6.5
Moyenne
CVE-2026-93573 A flaw was found in Netty's HTTP/1.1 decoder
Description
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat AMQ Broker 7 | Versions non publiées | |
| Red Hat AMQ Clients | Versions non publiées | |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Versions non publiées | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions non publiées | |
| Red Hat build of Apicurio Registry 3 | Versions non publiées | |
| Red Hat build of Debezium 3 | Versions non publiées | |
| Red Hat Build of Keycloak | Versions non publiées | |
| Red Hat build of Quarkus | Versions non publiées | |
| Red Hat Data Grid 8 | Versions non publiées |
Afficher les 7 autres branches Masquer les 7 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Fuse 7 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions non publiées | |
| Red Hat Single Sign-On 7 | Versions non publiées | |
| Red Hat build of Quarkus 3.27.5.SP2 | Versions non publiées | |
| Red Hat build of Quarkus 3.33.3.SP2 | Versions non publiées | |
| Red Hat Build of Debezium 3.6 | Versions non publiées |
Références
- RHSA-2026:69440 access.redhat.com
- RHSA-2026:69470 access.redhat.com
- RHSA-2026:83612 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2536964 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat AMQ Broker 7
Les 88 CVE de Red Hat AMQ Broker 7 →
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
Élevée
CVE-2026-93998
Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
7.4
Élevée
CVE-2026-101292
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in…
8.2
Élevée
CVE-2026-93562
A flaw was found in Netty's HTTP/1 decoder
6.5
Moyenne