CVE-2026-93491

Published: Sep 18, 2026Modified: Oct 15, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (8)

https://access.redhat.com/errata/RHSA-2026:69440

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:69470

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:70257

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:83612

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-93491

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2536891

Source: secalert@redhat.com

https://github.com/netty/netty/releases/tag/netty-4.1.138.Final

Source: secalert@redhat.com

https://github.com/netty/netty/releases/tag/netty-4.2.18.Final

Source: secalert@redhat.com

Timeline

No history available yet.