Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

Summary

CVE	CVE-2026-93558
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-09-18 15:17:19 UTC
Updated	2026-10-15 17:17:30 UTC
Description	A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.010250000 probability, percentile 0.625810000 (date 2026-10-11)

Problem Types: CWE-1035 | CWE-1035 CWE-1035

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	CNA	CVSS	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source	Vendor	Product	Version	Platforms
CNA	Red Hat	Red Hat Build Of Apache Camel 3.33.3.SP2	unaffected 4.1.138.Final-redhat-00001 * rpm	Not specified
CNA	Red Hat	Red Hat Build Of Debezium 3.6	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Quarkus 3.27.5.SP2	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Quarkus 3.33.3.SP2	Not specified	Not specified
CNA	Red Hat	Red Hat AMQ Broker 7	Not specified	Not specified
CNA	Red Hat	Red Hat AMQ Clients	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Apache Camel 4 For Quarkus 3	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Apache Camel For Spring Boot 4	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Apicurio Registry 3	Not specified	Not specified
CNA	Red Hat	Red Hat Build Of Keycloak	Not specified	Not specified
CNA	Red Hat	Red Hat Data Grid 8	Not specified	Not specified
CNA	Red Hat	Red Hat Fuse 7	Not specified	Not specified
CNA	Red Hat	Red Hat JBoss Enterprise Application Platform 7	Not specified	Not specified
CNA	Red Hat	Red Hat JBoss Enterprise Application Platform 8	Not specified	Not specified
CNA	Red Hat	Red Hat Single Sign-On 7	Not specified	Not specified

Reference	Source	Link	Tags
access.redhat.com/errata/RHSA-2026:69470	[email protected]	access.redhat.com
bugzilla.redhat.com/show_bug.cgi	134c704f-9b21-4f2e-91b3-4a467353bcc0	bugzilla.redhat.com
access.redhat.com/errata/RHSA-2026:83612	[email protected]	access.redhat.com
access.redhat.com/security/cve/CVE-2026-93558	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:70257	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:69440	[email protected]	access.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Source	Time	Event
CNA	2026-09-10T00:42:37.000Z	Reported to Red Hat.
CNA	2026-09-10T00:42:37.000Z	Made public.

CNA: See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance.

There are currently no legacy QID mappings associated with this CVE.