CVE-2026-93558 Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive...

PT-2026-95398

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A flaw in the WebSocketServerExtensionHandler allows a remote, unauthenticated attacker to cause a Denial of Service DoS. By utilizing HTTP/1.1 pipelining—a technique where multiple HTTP reques...

CVE-2026-93491: Allocation of Resources Without Limits or Throttling

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumpti...

CVE-2026-93558: Undefined Security Weakness

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive...

CVE-2026-59899

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, "HttpContentEncoder" the superclass of the production handler "HttpContentCompressor" maintains a per-channel "ArrayDeque" named "acceptEncodingQueue" that accumulates...

CVE-2026-59899: Allocation of Resources Without Limits or Throttling

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...