CVE-2026-93491 PUBLISHED

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

Assigner: redhat
Reserved: 18.09.2026 Published: 18.09.2026 Updated: 18.09.2026

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Red Hat
Product	Red Hat AMQ Broker 7
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat AMQ Clients
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat build of Apache Camel 4 for Quarkus 3
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat build of Apache Camel for Spring Boot 4
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat build of Apicurio Registry 3
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat build of Debezium 3
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Build of Keycloak
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat build of Quarkus
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Data Grid 8
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Fuse 7
Versions	Default: unknown

Vendor	Red Hat
Product	Red Hat JBoss Enterprise Application Platform 7
Versions	Default: unknown

Vendor	Red Hat
Product	Red Hat JBoss Enterprise Application Platform 8
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Single Sign-On 7
Versions	Default: affected

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

References

Problem Types

Allocation of Resources Without Limits or Throttling CWE