CVE-2026-93568: Improper Input Validation

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty’s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss. The netty-all artifact is a shaded jar that embeds the vulnerable HttpConversionUtil class; only versions 4.1.65 up to and including 4.1.68 both embed the class and accept Extended CONNECT requests. From version 4.1.69 onwards it ships no bytecode and is not affected.