Denial of Service Vulnerability in Netty Affected by Unbounded Stream Limit
CVE-2026-93488

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat Build Of Apache Camel 4 For Quarkus 3; Red Hat Build Of Apache Camel For Spring Boot 4
Vendor: CVE Published:; 18 September 2026

What is CVE-2026-93488?

A vulnerability exists in the Netty framework where the SpdySessionHandler does not limit the number of concurrent remote-initiated streams. Due to localConcurrentStreams being set to Integer.MAX_VALUE by default, a remote peer can initiate a significant number of SYN_STREAM frames with FLAG_FIN=0. This can result in excessive heap and direct memory allocation, potentially causing a JVM OutOfMemoryError and leading to a denial of service for affected systems.