CVE-2026-93558 Red Hat CVE debrief

Who should care

Defenders responsible for Red Hat Build of Apache Camel 3.33.3.SP2, Red Hat build of Quarkus 3.27.5.SP2, and other affected systems should assess exposure and apply patches or mitigations to prevent potential DoS attacks.

Why it matters

CVE-2026-93558 vulnerability in Netty's WebSocketServerExtensionHandler can lead to DoS attacks; defenders should assess exposure and apply patches.

• Potential Denial of Service (DoS) due to excessive memory consumption
• Need to assess exposure of affected systems
• Priority to apply patches or mitigations
• Verification of system updates and security patches

Technical summary

The vulnerability in Netty's WebSocketServerExtensionHandler allows for unbounded per-connection queue growth, leading to a Denial of Service (DoS) due to excessive memory consumption. This can be exploited by a remote, unauthenticated attacker using HTTP/1.1 pipelining. The issue arises from the handler's inability to limit the growth of the queue, which can be triggered by sending requests faster than the application can respond. Affected systems include Red Hat Build of Apache Camel 3.33.3.SP2 and Red Hat build of Quarkus 3.27.5.SP2. Defenders should prioritize assessing exposure and applying patches or mitigations.

Defensive priority

Defenders should prioritize assessing exposure and applying patches or mitigations to prevent potential DoS attacks. This involves reviewing affected systems, such as Red Hat Build of Apache Camel 3.33.3.SP2, Red Hat build of Quarkus 3.27.5.SP2, and others, and ensuring they are updated with the latest security patches.

Recommended defensive actions

• Assess exposure of affected systems, such as Red Hat Build of Apache Camel 3.33.3.SP2 and Red Hat build of Quarkus 3.27.5.SP2
• Apply patches or mitigations provided by vendors, such as Red Hat
• Monitor systems for potential DoS attacks
• Review and update incident response plans
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems
• Track and verify system updates and security patches

Evidence notes

The CVE Program record and NVD vulnerability detail provide information on the vulnerability. Red Hat has released advisories, such as RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257, addressing this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.