CVE-2026-93558 Denial of service in Red Hat AMQ Broker 7
Remote attackers can cause denial of service in Netty-based servers by exploiting unbounded queue growth in WebSocket handling via HTTP pipelining.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93558?
CVE-2026-93558 is a high-severity denial of service vulnerability in Red Hat AMQ Broker 7, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
Weakness: CWE-1035
Which versions are affected by CVE-2026-93558?
How do I fix CVE-2026-93558?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-93558 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-93558 exists.
Sources
Also known as DEBIAN-CVE-2026-93558, GHSA-wfpc-rccm-rq4m, UBUNTU-CVE-2026-93558.