PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-93488 Red Hat CVE debrief

A denial of service vulnerability exists in the Netty library, specifically in the handling of SPDY streams. This issue allows a remote peer to cause an OutOfMemoryError by sending a large number of SYN_STREAM frames, leading to unbounded heap and direct memory allocation. The vulnerability arises from the SpdySessionHandler accepting an unlimited number of concurrent remote-initiated streams due to localConcurrentStreams defaulting to Integer.MAX_VALUE. This can lead to potential resource exhaustion and system instability if not addressed.

Vendor
Red Hat
Product
Red Hat Build of Apache Camel 3.33.3.SP2
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-18
Original CVE updated
2026-10-09
Advisory published
2026-09-18
Advisory updated
2026-10-09

Who should care

Defenders responsible for systems using affected Netty versions should assess exposure and prioritize verification and updates. This includes operators managing affected systems, platform administrators, vulnerability management teams, and security teams who need to ensure that their environments are protected against this denial of service vulnerability.

Why it matters

CVE-2026-93488 is a denial of service vulnerability in Netty's handling of SPDY streams. Defenders should verify exposure in systems using affected Netty versions, assess potential resource exhaustion, and prioritize updates or mitigations.

  • Potential resource exhaustion leading to system instability
  • Denial of service through OutOfMemoryError
  • Need for verification of exposure in affected systems
  • Priority on applying updates or mitigations

Technical summary

The SpdySessionHandler in Netty accepts an unlimited number of concurrent remote-initiated streams due to localConcurrentStreams defaulting to Integer.MAX_VALUE. A remote peer can exploit this by opening a SPDY connection and sending numerous SYN_STREAM frames with FLAG_FIN=0, leading to unbounded heap and direct memory allocation and potentially causing a JVM OutOfMemoryError and denial of service.

Defensive priority

Defenders should prioritize verifying exposure in systems using affected Netty versions and assess the impact of potential resource exhaustion.

Recommended defensive actions

  • Verify exposure in systems using affected Netty versions
  • Assess the impact of potential resource exhaustion
  • Apply updates from Red Hat or Netty as available
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. Red Hat has released advisories RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257 related to this issue. The Netty project has released updates addressing this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-93488 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-93488

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-93488 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-93488

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93488.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:69440

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:69470

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/errata/RHSA-2026:70257

    Supplemental source - vendor-advisory, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://access.redhat.com/security/cve/CVE-2026-93488

    Supplemental source - vdb-entry, x_refsource_REDHAT

  • Source reference

    Unverified legacy reference

    URL: https://github.com/netty/netty/releases/tag/netty-4.1.138.Final

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://github.com/netty/netty/releases/tag/netty-4.2.18.Final

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.