CVE-2026-93491 Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-93491?
CVE-2026-93491 is a high-severity vulnerability in Red Hat AMQ Broker 7, published on 18 Sep 2026.
Official description
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
Weakness: CWE-770
Which versions are affected by CVE-2026-93491?
How do I fix CVE-2026-93491?
Upgrade to a fixed version.
Is CVE-2026-93491 being exploited?
There is no known exploitation of CVE-2026-93491 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-AI69794, CLEANSTART-2026-FB52227, CLEANSTART-2026-YB51786, DEBIAN-CVE-2026-93491, GHSA-c593-fgx2-8jj6, UBUNTU-CVE-2026-93491.