Skip to main content
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Open TCP connection to HTTP server
  2. Delivery
    Pipeline many HTTP/1.1 requests
  3. Exploit
    Withhold reading responses
  4. Execution
    methodOverflowQueue grows unbounded
  5. Persist
    Heap memory exhausted
  6. Impact
    Service denial of service

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitable against any HTTP/1.1 server built on Netty's HttpServerCodec that accepts pipelined requests - the default HTTP server codec behavior. The concrete prerequisites are: (1) reachable Netty HTTP/1.1 endpoint, (2) attacker pipelines multiple HTTP/1.1 requests on one connection, and (3) attacker withholds reads so the methodOverflowQueue is never drained, driving unbounded heap growth. No authentication (PR:N), no user interaction (UI:N), and no non-default configuration are required. Limiting factors: impact is confined to availability (memory-exhaustion DoS, no data exposure); mitigations such as connection/request-rate limits, memory ceilings, or upstream proxies that cap pipelining reduce practical risk; only deployments running vulnerable Netty versions below 4.1.138.Final / 4.2.18.Final (or the corresponding patched Red Hat product builds) are affected.
Impact

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent and credible: a remote, unauthenticated attacker over the network can trigger an availability-only impact with low attack complexity and no user interaction. The impact is a pure denial of service (C:N/I:N/A:H) via heap exhaustion - there is no confidentiality or integrity exposure, so despite the 'High' rating this is not a code-execution or data-breach class issue. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input; a GitHub Security Advisory (GHSA-pvjx-v7vp-62vq, HTTP/1.1 unbounded resource usage) documents the flaw but that is a disclosure advisory, not weaponized exploit code. Net assessment: a genuinely exploitable, low-effort DoS against a hugely prevalent library, but with bounded impact (service disruption only) and no evidence of active exploitation - prioritize patching of internet-facing Netty-based HTTP servers, but it is not a confidentiality/integrity emergency. Note the affected-versions and patch data comes from Netty release notes and Red Hat, not NVD CPE version ranges, so exact fixed builds should be confirmed per downstream product.
Exploit ScenarioDerived

An attacker opens a single TCP connection to a Netty-based HTTP/1.1 server, pipelines a large stream of HTTP/1.1 requests while deliberately not reading responses (withholding reads), causing the server's methodOverflowQueue to grow without bound until the JVM heap is exhausted and the service crashes or becomes unresponsive. No authentication or user interaction is required. A GHSA advisory describes the flaw but no public weaponized exploit was identified in the provided data.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Unbounded heap memory consumption in Netty's HttpServerCodec (io.netty:netty-codec-http) lets a remote, unauthenticated attacker drive a denial of service by exhausting server memory. An attacker who pipelines multiple HTTP/1.1 requests on a single connection and withholds reads prevents the internal methodOverflowQueue from being drained, so memory grows without limit; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is availability-only with no confidentiality or integrity impact, and no public exploit code was identified at time of analysis. Any HTTP/1.1 server built on the default Netty codec behavior is affected, and fixes ship in Netty 4.1.138.Final and 4.2.18.Final, with corresponding patched Red Hat product builds referenced through the Red Hat advisory.

RemediationAI

Vendor-released patch: Netty 4.1.138.Final (4.1.x line) and Netty 4.2.18.Final (4.2.x line), as documented in the release notes at https://github.com/netty/netty/releases/tag/netty-4.1.138.Final and https://github.com/netty/netty/releases/tag/netty-4.2.18.Final; upgrade to the appropriate fixed release for the branch in use and rebuild any shaded or fat-jar distributions that embed Netty. Red Hat customers should apply the patched product builds identified in the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-93491) and its Bugzilla tracker (https://bugzilla.redhat.com/show_bug.cgi?id=2536891), since replacing the dependency directly inside a supported product is not a substitute for the vendor rebuild. Where immediate upgrade is not possible, compensating controls should target the specific trigger, namely unbounded pipelining plus withheld reads: terminate or front the Netty service with a reverse proxy or load balancer that normalizes or disables HTTP/1.1 pipelining (trade-off: some legitimate clients that pipeline will see added latency or connection churn, and HTTP/1.0 semantics may need to remain enabled for compatibility); enforce aggressive per-connection request-rate and concurrent-connection caps plus short keep-alive/idle and write timeouts so a stalled reader is disconnected rather than accumulating queued requests (trade-off: aggressive timeouts can sever slow but legitimate clients); and place a hard bound on JVM heap (-Xmx) combined with container memory limits so exhaustion is contained to the affected instance rather than the node (trade-off: no memory headroom, and the service fails faster under other load spikes). Continuous heap-growth monitoring with alerting on sustained allocation in HTTP worker threads provides early detection while patched builds are being rolled out.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The root cause class is CWE-770 (Allocation of Resources Without Limits or Throttling), applied to Netty's HTTP/1.1 server-side codec. HttpServerCodec handles pipelined requests: when a client sends multiple requests back-to-back on one connection, decoded-but-not-yet-dispatched messages are held in an internal queue (referred to as methodOverflowQueue) that is drained as the application reads and the peer consumes responses. By pipelining requests and deliberately not reading responses, a remote client keeps that queue full and growing, so heap allocation increases with every additional inbound request and is never reclaimed, ultimately producing an OutOfMemoryError-style failure of the JVM process. Because the behavior is the default codec behavior and requires no non-default configuration, no authentication (PR:N), and no user interaction (UI:N), exposure is broad across Netty-based HTTP/1.1 servers; the trigger is a protocol-level property (HTTP/1.1 pipelining plus withheld reads) rather than a memory-safety bug, and impact is confined to availability. Red Hat's advisory infrastructure tracks the flaw across its Netty-consuming products, and the two referenced Netty release notes (netty-4.1.138.Final, netty-4.2.18.Final) each list a matching 'unbounded resource usage in io.netty:netty-codec-http (HTTP/1.1)' entry (GHSA-pvjx-v7vp-62vq); the release notes bundle many unrelated codec fixes, so the specific advisory-to-CVE mapping should be confirmed against the vendor's own security page rather than inferred from the changelog alone.

Know when Netty gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Remote unauthenticated network attacker, low complexity, no UI; pure memory-exhaustion DoS gives A:H with no confidentiality or integrity impact - matches the vendor 7.5.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.

Executive ViewAI

Why It Matters

Netty's HTTP server codec (io.netty:netty-codec-http) contains an unbounded heap memory consumption flaw that lets a remote, unauthenticated attacker cause a denial of service, potentially taking down any HTTP/1.1 service built on the default Netty codec. This availability-only vulnerability affects internet-facing services and could lead to significant downtime, SLA breaches, and customer dissatisfaction, though there is no risk of data breach. No public exploit identified at time of analysis. Leadership should prioritize patching to maintain service uptime and reliability.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.4%
Top 62% exploitable
Prevalence
Ubiquitous
Netty is a core async networking library embedded in vast numbers of JVM applications
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:red_hat:red_hat_amq_broker_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_amq_clients:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_apache_camel_4_for_quarkus_3:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_apache_camel_for_spring_boot_4:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_apicurio_registry_3:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_debezium_3:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_keycloak:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_build_of_quarkus:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_data_grid_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_fuse_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_7:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_jboss_enterprise_application_platform_8:*:*:*:*:*:*:*:*
cpe:2.3:a:red_hat:red_hat_single_sign-on_7:*:*:*:*:*:*:*:*

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2024-36121 CRITICAL POC
9.1 Jun 04

netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
CVE-2024-40642 HIGH POC
8.1 Jul 18

The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-59903 HIGH POC
7.5 Aug 17

Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final an
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93491 ADVISORY https://vuldb.com/vuln/407475 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4391/ REF https://access.redhat.com/errata/RHSA-2026:69440 REF https://access.redhat.com/errata/RHSA-2026:69470 REF https://access.redhat.com/errata/RHSA-2026:70257 REF https://access.redhat.com/errata/RHSA-2026:83612 REF https://access.redhat.com/security/cve/CVE-2026-93491 REF https://bugzilla.redhat.com/show_bug.cgi?id=2536891 REF https://github.com/netty/netty/releases/tag/netty-4.1.138.Final REF https://github.com/netty/netty/releases/tag/netty-4.2.18.Final

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy