Denial of Service Vulnerability in Netty Affected by Unbounded Stream Limit
CVE-2026-93488

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Build Of Apache Camel 3.33.3.sp2; Red Hat Build Of Quarkus 3.27.5.sp2; Red Hat Build Of Quarkus 3.33.3.sp2; Red Hat AMQ Broker 7
Vendor: CVE Published:; 18 September 2026

What is CVE-2026-93488?

A vulnerability exists in the Netty framework where the SpdySessionHandler does not limit the number of concurrent remote-initiated streams. Due to localConcurrentStreams being set to Integer.MAX_VALUE by default, a remote peer can initiate a significant number of SYN_STREAM frames with FLAG_FIN=0. This can result in excessive heap and direct memory allocation, potentially causing a JVM OutOfMemoryError and leading to a denial of service for affected systems.