CVE-2026-93562: Red Hat Amq Broker 7

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.

Affected products

• Red Hat Red Hat Amq Broker 7
• Red Hat Red Hat Amq Clients
• Red Hat Red Hat Build Of Apache Camel 4 For Quarkus 3
• Red Hat Red Hat Build Of Apache Camel For Spring Boot 4
• Red Hat Red Hat Build Of Apicurio Registry 3
• Red Hat Red Hat Build Of Debezium 3
• Red Hat Red Hat Build Of Keycloak
• Red Hat Red Hat Build Of Quarkus 3.27.5.sp2
• Red Hat Red Hat Build Of Quarkus 3.33.3.sp2
• Red Hat Red Hat Data Grid 8
• Red Hat Red Hat Fuse 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7
• Red Hat Red Hat JBoss Enterprise Application Platform 8
• Red Hat Red Hat Single Sign-On 7

Published 2026-09-18. Last modified 2026-10-09.