CVE-2026-93558 PUBLISHED

Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

Assigner: redhat
Reserved: 18.09.2026 Published: 18.09.2026 Updated: 18.09.2026

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor Red Hat
Product Red Hat AMQ Broker 7
Versions Default: affected
Vendor Red Hat
Product Red Hat AMQ Clients
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Apache Camel 4 for Quarkus 3
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Apache Camel for Spring Boot 4
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Apicurio Registry 3
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Debezium 3
Versions Default: affected
Vendor Red Hat
Product Red Hat Build of Keycloak
Versions Default: affected
Vendor Red Hat
Product Red Hat build of Quarkus
Versions Default: affected
Vendor Red Hat
Product Red Hat Data Grid 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Fuse 7
Versions Default: unknown
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7
Versions Default: unknown
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Single Sign-On 7
Versions Default: affected

Workarounds

See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance.

References

Problem Types

  • CWE-1035 CWE