Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach exposed SPDY endpoint
  2. Delivery
    Open SPDY connection
  3. Exploit
    Flood SYN_STREAM frames with FLAG_FIN=0
  4. Execution
    Exhaust heap and direct memory
  5. Impact
    JVM OutOfMemoryError denial of service

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires that the target application has explicitly configured Netty's SPDY support (SpdySessionHandler / netty-codec-http SPDY pipeline) and exposed that endpoint to attackers - SPDY is not enabled by default and is a deprecated protocol, which is the primary limiting factor. There is no API to change localConcurrentStreams from its Integer.MAX_VALUE default, so any deployment that does expose SPDY is affected. Once SPDY is reachable, no authentication, user interaction, or non-default protocol setting is needed (AV:N/AC:L/PR:N/UI:N); the attacker simply sends many SYN_STREAM frames with FLAG_FIN=0. Fixed by upgrading to netty 4.1.138.Final or 4.2.18.Final.
Impact

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes an unauthenticated, network-reachable, low-complexity attack with pure availability impact and no confidentiality or integrity loss - an availability-only denial-of-service, consistent with CWE-770 (uncontrolled resource consumption). No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is no public exploit identified at time of analysis; there is no evidence of active or widespread exploitation. The headline 7.5 is driven entirely by A:H under a default localConcurrentStreams of Integer.MAX_VALUE with no API to lower it, but real-world risk is materially lower than the score implies because the vulnerable code path is Netty's SPDY handler (SpdySessionHandler in netty-codec-http), and SPDY is a deprecated protocol that must be explicitly wired into a pipeline and exposed. The many affected Red Hat products reflect transitive bundling of the Netty library rather than confirmation that each ships an exposed SPDY listener. Net: a legitimate unauthenticated DoS worth patching, but a targeted/low-likelihood issue in practice rather than a mass-exploitation priority.
Exploit ScenarioDerived

An attacker who can reach a service that has enabled Netty's SPDY handler opens a SPDY connection and floods it with SYN_STREAM frames carrying FLAG_FIN=0. Because the handler accepts an unlimited number of concurrent remote-initiated streams, each stream drives unbounded heap and direct-memory allocation until the JVM throws OutOfMemoryError and the service crashes. No authentication or user interaction is required, but no public proof-of-concept was provided in the source data.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Unbounded remote-initiated stream creation in Netty's SpdySessionHandler allows an unauthenticated, network-positioned attacker to exhaust JVM heap and direct memory on any application that exposes a SPDY endpoint, producing OutOfMemoryError and a denial of service. The handler initializes localConcurrentStreams to Integer.MAX_VALUE and provides no API to change it, so no supported configuration knob reduces the exposure once SPDY is reachable; Netty 4.1.x before 4.1.138.Final and 4.2.x before 4.2.18.Final are affected, along with the Red Hat products that bundle those versions (AMQ Broker and AMQ Clients, Camel for Quarkus 3 and for Spring Boot 4, Keycloak, Quarkus, Debezium, Apicurio Registry, Data Grid, Fuse, JBoss EAP 7/8, and RH-SSO 7). Exploitation requires the target application to have explicitly wired the SPDY handler into its Netty pipeline, since SPDY is a deprecated protocol that is not enabled by default; there is no public exploit identified at time of analysis, and the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) reflects a low-complexity, availability-only denial of service with no confidentiality or integrity impact.

RemediationAI

Vendor-released patch: upgrade io.netty:netty-codec-http to 4.1.138.Final or 4.2.18.Final (the releases that contain the SPDY unbounded-resource fix), and for Red Hat subscribers apply the errata referenced from https://access.redhat.com/security/cve/CVE-2026-93488 and https://bugzilla.redhat.com/show_bug.cgi?id=2536887, which cover AMQ Broker/Clients, Camel for Quarkus 3 and Spring Boot 4, Apicurio Registry 3, Debezium 3, Keycloak, Quarkus, Data Grid 8, Fuse 7, JBoss EAP 7/8, and RH-SSO 7; because the handler offers no API to lower localConcurrentStreams, there is no Netty-level configuration workaround, so the primary compensating control is to remove the SPDY codec from the channel pipeline entirely (do not install SpdySessionHandler or reference netty-codec-http SPDY classes) - the trade-off is that any residual SPDY clients lose protocol support, which is generally acceptable given SPDY is deprecated and superseded by HTTP/2. As a secondary, partial mitigation for environments that cannot immediately drop SPDY, cap the JVM heap (for example via -Xmx plus container memory limits) and enable heap-dump-on-OOM monitoring to speed detection, understanding that this only converts a slow OOM into a faster one and does not prevent the denial of service; where SPDY must remain reachable and patching is delayed, restrict network access to the SPDY listener with firewall rules or a reverse proxy that rejects SPDY, accepting the operational cost of a narrower client population.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in Netty's SPDY implementation shipped in the io.netty:netty-codec-http artifact, specifically SpdySessionHandler, and maps to CWE-770 (Allocation of Resources Without Limits or Throttling). SPDY is a deprecated, HTTP/2-predecessor framing protocol whose session semantics require the peer to limit the number of concurrently open streams; Netty instead seeds localConcurrentStreams with Integer.MAX_VALUE and exposes no setter or channel option, so the cap is effectively absent. A remote peer that can reach a SPDY-capable listener opens a session and streams SYN_STREAM frames with FLAG_FIN=0 (never terminating the streams), each of which causes the handler to track and allocate state for an additional stream, producing unbounded heap and direct-buffer growth until the JVM throws OutOfMemoryError. The CPE data shows the vulnerability propagating far beyond standalone Netty deployments: Red Hat AMQ Broker 7, AMQ Clients, Red Hat Build of Apache Camel 4 for Quarkus 3, Camel for Spring Boot 4, Apicurio Registry 3, Debezium 3, Red Hat Build of Keycloak, Red Hat Build of Quarkus, Data Grid 8, and Fuse 7 all embed the affected Netty codec, and the associated tags add JBoss EAP 7/8 and RH-SSO 7 as consumers of the same library. Every one of these CPE entries is version-wildcarded, meaning the exposure is determined by whether the shipped Netty dependency predates the fixed releases and whether SPDY is actually enabled in the application's channel pipeline.

Know when Netty gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Unauthenticated remote flood of a reachable SPDY endpoint (AV:N/AC:L/PR:N/UI:N) with availability-only impact via OOM (A:H); the SPDY-enabled requirement is a deployment gate, not attack complexity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.

Executive ViewAI

Why It Matters

Netty, a widely embedded Java networking library, contains a high-severity denial-of-service flaw (CVE-2026-93488) that lets a network-positioned attacker exhaust JVM heap and direct memory on any service exposing a SPDY endpoint, causing OutOfMemoryError and loss of availability. Because Netty is bundled into many Red Hat enterprise products - including AMQ Broker and Clients, Keycloak, Quarkus, JBoss EAP 7/8, Data Grid, Fuse and RH-SSO 7 - a broad set of internal and customer-facing platforms could be affected if SPDY handlers are wired into their pipelines. Exposure is limited to applications that have explicitly enabled the deprecated SPDY protocol, so leadership should treat this as a targeted availability risk requiring inventory and mitigation rather than an imminent, widely exploitable event.

Business Impact: Medium
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: remove or disable the SPDY handler and SPDY listeners wherever SPDY is not a business requirement; block SPDY ports at the network edge or load balancer; constrain JVM heap and direct memory with -Xmx and -XX:MaxDirectMemorySize; apply reverse-proxy or WAF limits on concurrent streams per connection; monitor for OutOfMemoryError and rapid memory growth; and plan upgrades to Netty 4.1.138.Final or 4.2.18.Final, or the equivalent vendor-shipped build, as soon as available.

Threat Intelligence Overview

EPSS Score
0.5%
Top 61% exploitable
Prevalence
High
Netty is a ubiquitous JVM networking library, but the vulnerable SPDY handler is rarely enabled
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.5%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Medium
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_amq_broker_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_amq_clients:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_apache_camel_4_for_quarkus_3:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_apache_camel_for_spring_boot_4:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_apicurio_registry_3:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_debezium_3:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_quarkus:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_data_grid_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_fuse_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_single_sign-on_7:*:*:*:*:*:*:*:*

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2024-36121 CRITICAL POC
9.1 Jun 04

netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
CVE-2024-40642 HIGH POC
8.1 Jul 18

The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-59903 HIGH POC
7.5 Aug 17

Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final an
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93488 ADVISORY https://vuldb.com/vuln/407474 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4391/ REF https://access.redhat.com/errata/RHSA-2026:69440 REF https://access.redhat.com/errata/RHSA-2026:69470 REF https://access.redhat.com/errata/RHSA-2026:70257 REF https://access.redhat.com/errata/RHSA-2026:83612 REF https://access.redhat.com/security/cve/CVE-2026-93488 REF https://bugzilla.redhat.com/show_bug.cgi?id=2536887 REF https://github.com/netty/netty/releases/tag/netty-4.1.138.Final REF https://github.com/netty/netty/releases/tag/netty-4.2.18.Final

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy