CVE-2026-93491: Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
Other sources
Netty is an asynchronous event-driven network application framework widely used for HTTP and other protocols.
A public GitHub Security Advisory (GHSA-pvjx-v7vp-62vq) reports that HttpServerCodec tracks, per connection, which HTTP method each still-unanswered pipelined request used. The first 32 pending entries are bit-packed into a single long, but every entry beyond that spills into methodOverflowQueue, an ArrayDeque with no upper bound.
A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on one connection while withholding reads can grow this queue without limit, causing unbounded heap growth and a memory-exhaustion denial of service. This is the same defect class previously fixed in the sibling class HttpContentEncoder (CVE-2026-59899); HttpServerCodec did not receive the equivalent pipeline-depth bound.
Affected package: io.netty:netty-codec-http Affected versions: <= 4.1.137.Final and >= 4.2.0.Final, <= 4.2.17.Final Fixed versions: 4.1.138.Final and 4.2.18.Final
Advisory: https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.1.138.FinalPatch GHSA-pvjx-v7vp-62vq - Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.2.18.FinalPatch GHSA-pvjx-v7vp-62vq
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service condition?
Applications using Netty's HttpServerCodec and accepting HTTP/1.1 connections are exposed if an attacker can connect to the service. The attacker does not need authentication or user interaction.
What must an attacker do to trigger the issue?
The attacker pipelines HTTP/1.1 requests over a single connection and withholds reads. This leaves requests unanswered and causes per-connection method tracking entries to accumulate in the unbounded methodOverflowQueue.
What is the operational impact?
The queue can grow without limit, consuming heap memory until the process experiences memory exhaustion. This can deny service to the affected application.
How can I determine whether an instance may be affected?
Review whether the application uses Netty's HttpServerCodec for HTTP/1.1 traffic and permits pipelined requests on persistent connections. During an attack, affected instances may show unbounded heap growth associated with connections that have many pending, unanswered pipelined requests.