CVE-2026-93579: Red Hat Amq Broker 7

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.

Affected products

• Red Hat Red Hat Amq Broker 7
• Red Hat Red Hat Build Of Apache Camel 4 For Quarkus 3
• Red Hat Red Hat Build Of Apache Camel For Spring Boot 4
• Red Hat Red Hat Build Of Apicurio Registry 3
• Red Hat Red Hat Build Of Debezium 3
• Red Hat Red Hat Build Of Keycloak
• Red Hat Red Hat Data Grid 8
• Red Hat Red Hat Fuse 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7
• Red Hat Red Hat JBoss Enterprise Application Platform 8
• Red Hat Red Hat Single Sign-On 7

Published 2026-09-18. Last modified 2026-09-29.