CVE-2026-93567 in AMQ Broker
Summary
by MITRE • 09/18/2026
HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability described involves a critical protocol translation error within network infrastructure components that act as intermediaries between HTTP/1 and HTTP/2 clients or servers. Specifically, when an HTTP/1 client issues a CONNECT method request using the authority-form syntax to establish a tunnel for protocols such as HTTPS over TCP, certain proxy implementations incorrectly translate this into a malformed HTTP/2 CONNECT frame. In HTTP/2, the :authority pseudo-header field is used to specify the target host and port, whereas HTTP/1 uses the Request-URI line in its own specific format during CONNECT requests. The flaw arises when the translation logic fails to properly map or validate these fields, resulting in an improperly constructed HTTP/2 frame that may contain unexpected or unvalidated data derived from the original Host header of the HTTP/1 request.
This technical flaw creates a significant security risk because it allows for potential host-controlled :authority manipulation. If the intermediary does not strictly enforce validation rules during this translation process, an attacker could craft malicious HTTP/1 CONNECT requests that result in malformed or misleading HTTP/2 frames being sent to downstream servers. This can lead to server-side request smuggling scenarios where the backend interprets the connection parameters differently than intended by the proxy layer. The misinterpretation of the :authority field may allow attackers to bypass access controls, redirect traffic to unintended destinations, or exploit trust relationships between internal services that rely on accurate host identification for authentication and authorization decisions.
The operational impact of this vulnerability is severe in environments where HTTP/1 clients communicate through proxies to reach HTTP/2 backends. Attackers can leverage the malformed translation to perform header injection attacks, potentially leading to cache poisoning if caching mechanisms are involved, or session hijacking if cookies or tokens are transmitted over the tunneled connection. Furthermore, because the CONNECT method is often used for secure tunneling, any compromise in its integrity undermines the confidentiality and integrity guarantees provided by TLS when applied over these tunnels. This can result in unauthorized access to internal resources that should be protected from external networks, effectively bypassing perimeter security controls designed to filter or inspect HTTP traffic based on host headers.
Mitigation strategies must focus on strict validation of incoming requests before translation occurs. Developers and system administrators should ensure that proxy software is updated to the latest versions where this logic error has been corrected. It is essential to implement rigorous input sanitization for Host headers in HTTP/1 CONNECT requests, ensuring they conform strictly to RFC standards before being converted into HTTP/2 :authority fields. Additionally, deploying Web Application Firewalls with rules specifically tuned to detect anomalies in protocol translation can help identify and block attempts to exploit this flaw. Regular security audits of proxy configurations are recommended to verify that the mapping between HTTP/1 authority-form and HTTP/2 pseudo-headers is handled securely without allowing user-controlled data to influence critical routing parameters improperly.
From a classification perspective, this vulnerability aligns with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, as it involves the injection of malicious or malformed elements during protocol translation. It also relates to CWE-693 Protection Mechanism Failure, specifically where the protection mechanism fails to prevent an attacker from manipulating request parameters due to implementation errors. In terms of attack tactics, this falls under MITRE ATT&CK technique T1071 Application Layer Protocol: Web Protocols, as it exploits the nuances of HTTP protocol behavior for malicious purposes. Understanding these classifications helps in prioritizing remediation efforts and aligning security controls with industry-standard frameworks to mitigate similar translation-based vulnerabilities across diverse network architectures.