Unbounded Heap Memory Consumption in Netty HttpServerCodec
CVE-2026-93491

7.5HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat Build Of Apache Camel 4 For Quarkus 3; Red Hat Build Of Apache Camel For Spring Boot 4
Vendor: CVE Published:; 18 September 2026

What is CVE-2026-93491?

A flaw in Netty's HttpServerCodec allows a remote, unauthenticated attacker to exploit the system by pipelining HTTP/1.1 requests on a single connection while withholding reads. This causes the methodOverflowQueue to expand indefinitely, leading to unbounded heap memory consumption. Consequently, the system may experience denial of service due to memory exhaustion, impacting overall application availability.