Bug 2536891 (CVE-2026-93491)

Summary:	CVE-2026-93491 io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ant, anujha, aschwart, asoldano, aszczucz, ataylor, bbaranow, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, csuconic, dbruscin, dlofthou, drichtar, ehugonne, ewittman, fmariani, fmongiar, gmalinko, gsmet, gtully, istudens, ivassile, iweiss, janstey, jmartisk, jnethert, jpechane, jsherman, jwon, kvanderr, manderse, mcarlett, mosmerov, mposolda, msvehla, nipatil, nwallace, olubyans, ozzy, pantinor, pberan, pdelbell, pesilva, pjindal, pmackay, rgemmell, rgodfrey, rguimara, rkubis, rmartinc, rstancel, rstepani, sbiarozk, ssilvert, sthorger, tbish, tcunning, thjenkin, tlavocat, varjain, vdosoudi, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-18 07:03:01 UTC

Netty is an asynchronous event-driven network application framework widely used for HTTP and other protocols.

A public GitHub Security Advisory (GHSA-pvjx-v7vp-62vq) reports that HttpServerCodec tracks, per connection, which HTTP method each still-unanswered pipelined request used. The first 32 pending entries are bit-packed into a single long, but every entry beyond that spills into methodOverflowQueue, an ArrayDeque with no upper bound.

A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on one connection while withholding reads can grow this queue without limit, causing unbounded heap growth and a memory-exhaustion denial of service. This is the same defect class previously fixed in the sibling class HttpContentEncoder (CVE-2026-59899); HttpServerCodec did not receive the equivalent pipeline-depth bound.

Affected package: io.netty:netty-codec-http
Affected versions: <= 4.1.137.Final and >= 4.2.0.Final, <= 4.2.17.Final
Fixed versions: 4.1.138.Final and 4.2.18.Final

Advisory: https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq