CVE-2026-93491 Red Hat CVE debrief

Who should care

Defenders responsible for systems using Netty's HttpServerCodec, particularly those exposed to untrusted HTTP/1.1 connections, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-93491 is a high-severity vulnerability in Netty's HttpServerCodec that can lead to denial of service via unbounded HTTP/1.1 pipeline queue growth. Defenders should assess exposure, particularly in systems using affected Netty versions, and prioritize verification, patching, and monitoring.

• Denial of service due to memory exhaustion.
• Potential for performance degradation under sustained exploitation attempts.
• Need for verification of affected systems and application of patches.
• Possible impact on service availability if not mitigated.

Technical summary

CVE-2026-93491 is a high-severity vulnerability in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this by pipelining HTTP/1.1 requests on a single connection and withholding reads, causing the methodOverflowQueue to grow without limit and leading to unbounded heap memory consumption and a denial of service due to memory exhaustion. The vulnerability affects systems using Netty's HttpServerCodec, particularly those exposed to untrusted HTTP/1.1 connections. Defenders should prioritize verifying affected systems, applying vendor patches, and monitoring for suspicious HTTP/1.1 pipelining activity.

Defensive priority

Defenders should prioritize verifying affected systems, applying vendor patches, and monitoring for suspicious HTTP/1.1 pipelining activity.

Recommended defensive actions

• Verify if systems using Netty's HttpServerCodec are exposed to untrusted HTTP/1.1 connections.
• Apply patches or updates provided by vendors like Red Hat.
• Monitor for suspicious HTTP/1.1 pipelining activity.
• Review and adjust configurations to limit exposure.
• Perform asset inventory of systems using affected Netty versions.
• Track exceptions and retest remediated assets.
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Red Hat has released advisories RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257 addressing the issue. Evidence is limited to public CVE and NVD information. Defenders should verify affected systems, review configurations, and apply patches or updates provided by vendors like Red Hat. Additional verification tasks are needed due to limited source detail.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.