CVE-2026-93562
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 18, 2026
Vendor
unknown
Description
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.