Improper Protocol Downgrade of Extended CONNECT Requests in HTTP/2 and HTTP/3

CVE-2026-93568 involves a flaw in the handling of HTTP/2 and HTTP/3 protocol features, specifically concerning the Extended CONNECT method. Extended CONNECT is designed to support advanced tunneling and proxying capabilities, often governed by stricter security policies than standard CONNECT requests. Due to this vulnerability, these requests are incorrectly downgraded to regular CONNECT requests by the affected protocol implementations. This behavior allows attackers to circumvent security controls or firewall policies specifically designed to filter, inspect, or block Extended CONNECT traffic. The vulnerability has a CVSS v3.1 base score of 7.5, indicating a high risk to organizations that depend on the semantic distinction between these request types to enforce network security boundaries. Defenders should identify endpoints performing protocol mediation and assess whether existing security rules account for potential downgrade attacks.

Impact

Successful exploitation could result in the bypass of security policies enforced on tunneling traffic. This may allow unauthorized communication through proxies or firewalls that expect Extended CONNECT semantics, potentially facilitating data exfiltration, C2 traffic, or unauthorized network traversal that would otherwise be blocked or logged under stricter inspection criteria.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Audit existing firewall and proxy configurations to determine if security policies for "Extended CONNECT" are distinct from standard "CONNECT" policies.
• Review vendor release notes and security advisories for HTTP/2 and HTTP/3 implementations (e.g., load balancers, proxies, and web server software) to identify if they are impacted by CVE-2026-93568 and apply available patches.
• Monitor logs for unusual instances of standard CONNECT requests originating from clients or segments that typically utilize Extended CONNECT-based protocols.