rootpwn

critical · CVSS v3 9.8

CVE-2026-93569

HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

Description

HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-93564

HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak allows memory exhaustion. The flaw resides in the handling of nested TLVs in the PROXY protocol. It can lead to denial of service on affected HAProxy instances.

View analysis

critical

CVE-2026-93565

CVE-2026-93565 allows an attacker to send RTSP requests with trailing control bytes that are silently stripped by RtspMethods.valueOf(), causing the server to treat them as valid method tokens. This flaw exists in Netty-based RTSP servers and can lead to unauthorized or malformed requests being accepted as legitimate. The vulnerability is critical with a CVSS v3 score of 9.8.

View analysis

critical

CVE-2026-93567

HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority

View analysis

critical

CVE-2026-93576

Netty netty-codec-smtp — SMTP command-name field is not CRLF-validated (incomplete fix of CVE-2025-59419)

View analysis