Improper Translation of HTTP/1 CONNECT to HTTP/2 Headers

CVE-2026-93567 describes a vulnerability in how certain proxying mechanisms handle the translation between HTTP/1 authority-form CONNECT requests and HTTP/2 CONNECT requests. When an HTTP/1 request is processed, the system may improperly translate it, resulting in a malformed HTTP/2 CONNECT request where the :authority pseudo-header is controlled by the input provided in the original Host header or request line. This flaw can be leveraged by an attacker to manipulate the :authority header, potentially bypassing security controls, routing restrictions, or authentication mechanisms enforced by downstream services that rely on accurate header information. Because this impacts the translation logic within proxy components, it is critical for infrastructure teams to review the handling of CONNECT requests in their web application firewalls, load balancers, and reverse proxy configurations.

Impact

Successful exploitation of this vulnerability allows for the manipulation of request headers in a way that may bypass security policy enforcement or lead to request smuggling within proxy environments. This impacts any infrastructure relying on HTTP/1 to HTTP/2 protocol transformation, potentially allowing unauthorized access to restricted internal resources or the circumvention of network-level security controls.

Recommendation

• Perform a security audit of all load balancers, proxies, and web servers that perform HTTP/1 to HTTP/2 protocol conversion.
• Review proxy configuration logs to identify unusually formatted CONNECT requests or those containing unexpected characters in the authority or host headers.
• Prioritize updates from your infrastructure vendors once patches addressing CVE-2026-93567 are released for your specific proxy software.