CVE-2026-93492 Red Hat CVE debrief

Who should care

Defenders managing HTTP/2 environments using Netty's HTTP/2 HpackEncoder should verify exposure and assess potential for DoS attacks. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of HTTP/2 environments. They should review vendor advisories and assess the potential impact on their systems.

Why it matters

CVE-2026-93492 is a medium-severity vulnerability in Netty's HTTP/2 HpackEncoder that can lead to increased CPU usage and memory consumption, potentially causing a Denial of Service (DoS). Defenders managing HTTP/2 environments using Netty's HTTP/2 HpackEncoder should verify exposure and assess potential for DoS attacks.

• Increased CPU usage and memory consumption
• Potential for Denial of Service (DoS) attacks
• Need for verification of exposure in HTTP/2 environments

Technical summary

The vulnerability is in Netty's HTTP/2 HpackEncoder. A remote attacker can cause a DoS by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE, leading to increased CPU usage and memory consumption. This technical issue arises from the HpackEncoder's handling of large MAX_HEADER_TABLE_SIZE values, which can cause the encoder to store an excessive number of unique headers. Defenders should prioritize verifying exposure in their HTTP/2 environments, especially where Netty's HTTP/2 HpackEncoder is used.

Defensive priority

Defenders should prioritize verifying exposure in their HTTP/2 environments, especially where Netty's HTTP/2 HpackEncoder is used, and assess the potential for DoS attacks.

Recommended defensive actions

• Verify exposure in HTTP/2 environments using Netty's HTTP/2 HpackEncoder
• Assess potential for DoS attacks
• Review and apply vendor advisories (RHSA-2026:69440, RHSA-2026:69470)
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE Program and NVD provide official records of the vulnerability. Red Hat also provides advisories (RHSA-2026:69440, RHSA-2026:69470) and a security page for CVE-2026-93492. Official records indicate a medium-severity vulnerability in Netty's HTTP/2 HpackEncoder. Vendor advisories should be reviewed for specific guidance on affected versions and patches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.