CVE-2026-93563: Netty: netty-codec-smtp: io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos
Unbounded multi-line response accumulation in SmtpResponseDecoder leads to memory-exhaustion DoS
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Point the Netty pipeline containing `io.netty.handler.codec.smtp.SmtpResponseDecoder` to an SMTP host that you control and/or place a network control in front of it so an attacker/MITM cannot stream unbounded continuation lines that never send the space-separated terminator (`250 x\r\n`).
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Netty-based SMTP clients or MTAs using io.netty.handler.codec.smtp.SmtpResponseDecoder are exposed when they process SMTP responses from a malicious server or from a server response modified by a man-in-the-middle attacker.
What does an attacker need to do to trigger memory exhaustion?
The attacker must send an SMTP multi-line response with continuation lines such as "250-x\r\n" and withhold the space-separated terminator line. Each continuation line is retained in a per-connection list across decoder invocations, allowing heap use to grow until the process fails.
Does the existing line-length limit prevent this issue?
No. The described maxLineLength control limits individual lines only; it does not cap the number of accumulated continuation lines or their total size. Accumulation is reset only when a space-separated terminating response line is received.