{"id":"CVE-2026-93491","aliases":[],"cve":{"records":[{"id":"CVE-2026-93491","source":"redhat","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-18T07:14:15.353Z","published":"2026-09-18T12:43:26.091Z","modified":"2026-11-06T17:12:08.274Z"}],"publishers":[{"name":"redhat","role":"CNA","organizationId":"53f830b8-0a3f-465b-8143-3b8a9948e749","modified":"2026-11-06T17:12:08.274Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-18T19:06:57.127Z"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:69440","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:69470","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:70257","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:83612","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95759","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95760","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95761","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95762","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/errata/RHSA-2026:95887","tags":["vendor-advisory","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93491","tags":["vdb-entry","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536891","tags":["issue-tracking","x_refsource_REDHAT"],"source":"redhat"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.138.Final","tags":[],"source":"redhat"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.18.Final","tags":[],"source":"redhat"}],"weaknesses":[{"id":"CWE-770","description":"Allocation of Resources Without Limits or Throttling","source":"redhat"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-18T19:06:39.794513Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue","titleSource":"redhat","descriptionSource":"redhat","description":"A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.","score":7.5,"severity":"high","published":"2026-09-18T12:43:26.091Z","modified":"2026-11-06T17:12:08.274Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Red Hat","name":"Red Hat Build of Apache Camel 3.33.3.SP2","platforms":[],"versions":[{"version":"4.1.138.Final-redhat-00001","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat Build of Debezium 3.6","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:debezium:3.6"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.4","platforms":[],"versions":[{"version":"26.4.17-2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.4","platforms":[],"versions":[{"version":"26.4-29","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.4","platforms":[],"versions":[{"version":"26.4-30","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.4.17","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.4::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6","platforms":[],"versions":[{"version":"26.6.8-2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6","platforms":[],"versions":[{"version":"26.6-24","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6","platforms":[],"versions":[{"version":"26.6-24","status":"unaffected","lessThan":"*","versionType":"rpm"}],"defaultStatus":"affected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Keycloak 26.6.8","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Quarkus 3.27.5.SP2","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Quarkus 3.33.3.SP2","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat JBoss Enterprise Application Platform 8.1","platforms":[],"versions":[],"defaultStatus":"unaffected","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.1"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat AMQ Broker 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:amq_broker:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat AMQ Clients","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:amq_clients:2023"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Apache Camel 4 for Quarkus 3","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:camel_quarkus:3"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Apache Camel for Spring Boot 4","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:camel_spring_boot:4"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat build of Apicurio Registry 3","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:apicurio_registry:3"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat Data Grid 8","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:jboss_data_grid:8"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat Fuse 7","platforms":[],"versions":[],"defaultStatus":"unknown","cpes":["cpe:/a:redhat:jboss_fuse:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat JBoss Enterprise Application Platform 7","platforms":[],"versions":[],"defaultStatus":"unknown","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"},{"vendor":"Red Hat","name":"Red Hat Single Sign-On 7","platforms":[],"versions":[],"defaultStatus":"affected","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"}],"remediation":[{"text":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","source":"redhat","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"}],"references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/errata/RHSA-2026:95759","https://access.redhat.com/errata/RHSA-2026:95760","https://access.redhat.com/errata/RHSA-2026:95761","https://access.redhat.com/errata/RHSA-2026:95762","https://access.redhat.com/errata/RHSA-2026:95887","https://access.redhat.com/security/cve/CVE-2026-93491","https://bugzilla.redhat.com/show_bug.cgi?id=2536891","https://github.com/netty/netty/releases/tag/netty-4.1.138.Final","https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"],"sources":[{"name":"CVE","id":"CVE-2026-93491","modified":"2026-11-06T17:12:08.274Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"}],"assessments":[{"source":"redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-06T18:03:26.275Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:30:32.029Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T14:55:34.912Z","attemptedAt":"2026-11-06T14:55:34.912Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-06T14:55:35.340Z","attemptedAt":"2026-11-06T14:55:35.340Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T14:55:35.150Z","attemptedAt":"2026-11-06T14:55:35.150Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-06T14:55:35.210Z","attemptedAt":"2026-11-06T14:55:35.210Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-93491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93491","modified":"2026-11-06T11:17:18.533","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-06T14:55:34.912Z"},{"source":"ENISA EUVD","id":"EUVD-2026-82902","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82902","modified":"Nov 6, 2026, 10:23:24 AM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-06T14:55:35.150Z"},{"source":"FIRST EPSS","id":"CVE-2026-93491","url":"https://www.first.org/epss/","probability":0.00734,"percentile":0.54577,"date":"2026-11-06","checkedAt":"2026-11-06T14:55:35.210Z"},{"source":"GitHub Advisory Database","id":"GHSA-c593-fgx2-8jj6","url":"https://github.com/advisories/GHSA-c593-fgx2-8jj6","modified":"2026-11-06T12:31:30Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-11-06T14:55:35.340Z"}],"aiSummary":{"text":"A flaw in Netty's HttpServerCodec allows a remote, unauthenticated attacker to cause unbounded heap memory consumption and a denial of service via pipelined HTTP/1.1 requests. The affected products and versions are not fully specified. The weakness is allocation of resources without limits or throttling.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T18:46:03.699Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93491"}]}}