CVE-2026-93563 PUBLISHED

Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos

Assigner: redhat
Reserved: 18.09.2026 Published: 18.09.2026 Updated: 18.09.2026

A flaw was found in Netty's SmtpResponseDecoder component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an OutOfMemoryError and a denial of service (DoS) due to a process crash.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Red Hat
Product	Red Hat build of Apache Camel for Spring Boot 4
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Fuse 7
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat JBoss Enterprise Application Platform 7
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat JBoss Enterprise Application Platform 7
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat JBoss Enterprise Application Platform 7
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat JBoss Enterprise Application Platform 7
Versions	Default: affected

Vendor	Red Hat
Product	Red Hat Single Sign-On 7
Versions	Default: affected

Workarounds

See https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q for fixed versions and remediation guidance.

References

Problem Types

CWE-1035 CWE