CVE-2026-93569: Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority
HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-http2to a version that resolves this vulnerability.Fixed in 4.1.135.Final - Upgrade
Upgrade
io.netty:netty-codec-http2to a version that resolves this vulnerability.Fixed in 4.2.15.Final - Configuration
Ensure HTTP/2 :authority is constructed from the HTTP/1 absolute-form request-target authority (authority from request-target) when it contains a scheme/authority, and do not override it with an attacker-controlled HTTP/1 Host header when Host differs. Alternatively, reject conversion when absolute-form request-target authority and Host differ after scheme-based normalization.
Netty HttpConversionUtil (HTTP/1 to HTTP/2 translation) :authority construction source = Set :authority from HTTP/1 request-target authority when present; reject or avoid translating absolute-form request-target authority conflicts with Host - Compensating control
In Netty-based HTTP/1-to-HTTP/2 proxy/gateway pipelines, add a validation step to detect and block requests where absolute-form request-target authority and the HTTP/1 Host header are mismatched before calling HttpConversionUtil.toHttp2Headers(...), since the mismatch can be translated into HTTP/2 :authority.
- Operational
After upgrading netty-codec-http2 to the fixed versions, run/enable regression tests for mismatched absolute-form authority vs Host, matching authority vs Host, origin-form Host behavior preservation, userinfo stripping, IPv6 literals, and explicit ports, to verify the conversion logic no longer allows authority/Host bypass.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Netty-based proxy or gateway pipelines that accept HTTP/1 requests and forward them over HTTP/2 are exposed when security decisions depend on the authority in an absolute-form request target. The issue creates a discrepancy between that request-target authority and the authority sent upstream.
What does an attacker need to send to exploit the behavior?
An attacker needs to send an HTTP/1 absolute-form request target whose authority conflicts with a nonempty Host header. No privileges or user interaction are indicated by the provided vector.
When does Netty use the request-target authority instead of the Host header?
Netty takes the authority from the absolute-form request line only when the Host header is empty. If Host is populated, it becomes the HTTP/2 :authority value while the request path is retained.