CVE-2026-93567: Improper Input Validation

September 18, 2026 (updated October 8, 2026)

A flaw was found in Netty’s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.

References

bugzilla.redhat.com/show_bug.cgi?id=2536955
github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg
nvd.nist.gov/vuln/detail/CVE-2026-93567

Code Behaviors & Features

Detect and mitigate CVE-2026-93567 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →