CVE-2026-93491

Summary

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.

Affected Software

Weaknesses

• CWE-770: Allocation of Resources Without Limits or Throttling

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://access.redhat.com/security/cve/CVE-2026-93491
• https://bugzilla.redhat.com/show_bug.cgi?id=2536891
• https://github.com/netty/netty/releases/tag/netty-4.1.138.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.18.Final

• ←Previous
• Next→