# CVE-2026-93579: Netty HTTP/2 header injection vulnerability

Source: https://junglewise.ai/threats/cve-2026-93579-a-flaw-was-found-in-netty-s-http-2-stack-this-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93579 · Severity: medium · CVSS 6.5 · Published 2026-09-18

Netty is a networking framework used in many Java applications to handle HTTP traffic. A flaw in its HTTP/2 implementation allows attackers to inject prohibited characters (like null bytes and line breaks) into HTTP headers, which can be exploited for request smuggling or response splitting attacks when HTTP/2 traffic is translated to HTTP/1.1. This could lead to unauthorized access or data manipulation on affected systems.

Technologies: [Netty Project Netty](https://junglewise.ai/threats/technologies/netty-project-netty). Vendors: [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-93579 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93579 being exploited in the wild.

**How severe is CVE-2026-93579?** Medium severity, with a CVSS score of 6.5, published 18 September 2026.

**Which products and versions are affected?** Netty Project Netty <UNKNOWN>.

**Is there a fix for CVE-2026-93579?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93579 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93579?** Check whether you run Netty Project Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Netty's HTTP/2 stack due to insufficient validation of header field values, allowing injection of NUL, Line Feed, and Carriage Return characters. These prohibited characters become exploitable for request smuggling, header injection, and response splitting attacks when HTTP/2 responses or requests cross a translation boundary to HTTP/1.1. An unauthenticated remote attacker can craft malicious HTTP/2 requests to trigger this behavior.

## Affected products

- Netty Project Netty <UNKNOWN>

## Timeline

- 2026-09-18: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)

## Related threats

- [Netty incomplete hostname verification in QUIC certificate verification](https://junglewise.ai/threats/cve-2026-100665-netty-versions-from-4-2-11-final-before-4-2-18-final-contain-an)
- [Netty netty-codec-http request smuggling via chunk-size parsing](https://junglewise.ai/threats/cve-2026-93574-a-flaw-was-found-in-netty-s-netty-codec-http-component-a-remote)
- [Netty RedisArrayAggregator heap memory exhaustion](https://junglewise.ai/threats/cve-2026-93572-a-flaw-was-found-in-netty-s-redisarrayaggregator-component-a)
- [Netty SmtpResponseDecoder unbounded memory accumulation](https://junglewise.ai/threats/cve-2026-93563-a-flaw-was-found-in-netty-s-smtpresponsedecoder-component-a)
- [Netty memory leak in StompSubframeDecoder](https://junglewise.ai/threats/cve-2026-93494-a-flaw-was-found-in-netty-s-stompsubframedecoder-component-a)