Netty CVE-2026-93563

Requires the affected application to use Netty's SMTP client codec (SmtpResponseDecoder) and to establish an SMTP session with a server the attacker controls or can intercept (MITM), since the vulnerable path parses multi-line server *responses*; the attacker then sends an unbounded stream of continuation lines to exhaust heap. Limiting factors: it is not triggered by arbitrary inbound traffic to the host - it depends on the app initiating/holding an SMTP client connection to a hostile peer, on that SMTP integration actually being enabled and reachable, and on the JVM heap ceiling. No authentication or user interaction is needed on the victim side (PR:N/UI:N), but the client-side SMTP interaction requirement meaningfully narrows realistic exposure versus a raw network DoS.

The vendor CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) frames this as a network-reachable, unauthenticated, pure-availability denial of service, and the metrics are internally consistent with the description of unbounded multi-line SMTP response accumulation in Netty's SmtpResponseDecoder leading to memory exhaustion - I broadly agree with A:H and C:N/I:N. The key real-world nuance the vector understates: a *response* decoder is exercised when the affected application acts as an SMTP client parsing replies from a server, so triggering it typically requires the victim application to connect to an attacker-controlled or man-in-the-middle SMTP server rather than a raw inbound request, which moderates the practical AC:L/PR:N optimism. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced (only the Red Hat advisory, Bugzilla 2536976, and the NVD entry), so exploitation status is 'no public exploit identified at time of analysis' - this is a plausible-but-not-demonstrated DoS, not an actively exploited priority. Net: a legitimate hardening fix worth patching in exposed mail-integration paths, but not an emergency; the memory-exhaustion class is real yet gated by the client-side SMTP interaction pattern.

An application built on Red Hat Fuse 7 / EAP 7 / SSO 7 / Camel-Spring-Boot 4 uses Netty's SMTP client codec to talk to a mail server; an attacker who controls or MITMs that SMTP server returns an endless multi-line response (many '250-' continuation lines). SmtpResponseDecoder buffers the accumulating lines without an upper bound, driving the JVM toward OutOfMemoryError and crashing or hanging the service. No public proof-of-concept is referenced, and the attack requires influence over the SMTP peer the victim connects to.