Unbounded Heap Memory Consumption in Netty HttpServerCodec
CVE-2026-93491

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Build Of Apache Camel 3.33.3.sp2; Red Hat Build Of Quarkus 3.27.5.sp2; Red Hat Build Of Quarkus 3.33.3.sp2; Red Hat AMQ Broker 7
Vendor: CVE Published:; 18 September 2026

What is CVE-2026-93491?

A flaw in Netty's HttpServerCodec allows a remote, unauthenticated attacker to exploit the system by pipelining HTTP/1.1 requests on a single connection while withholding reads. This causes the methodOverflowQueue to expand indefinitely, leading to unbounded heap memory consumption. Consequently, the system may experience denial of service due to memory exhaustion, impacting overall application availability.