CVE-2026-93567: Improper Input Validation

A flaw was found in Netty’s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss. The netty-all artifact is a shaded jar that embeds the vulnerable HttpConversionUtil class up to and including version 4.1.68; from version 4.1.69 onwards it ships no bytecode and is not affected.