CVE-2026-93558

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.

Score
CVSS 3.1 7.5 High
Status
Awaiting Analysis - secalert@redhat.com
Published
2026-09-18
Last modified
2026-10-15
Weaknesses
CWE-1035

Affected products

References

 
 
© AVABIS GmbH privacypolicy about