CVE-2026-93491

Executive Summary

CVE-2026-93491 is an unbounded resource allocation vulnerability (CWE-770) in Netty's HttpServerCodec that allows a remote, unauthenticated attacker to exhaust server heap memory by pipelining HTTP/1.1 requests on a single connection while withholding reads. The flaw causes the internal methodOverflowQueue to grow without limit, driving the JVM toward OutOfMemoryError and a denial-of-service condition. The defect affects any Java application or microservice that exposes HTTP endpoints through Netty's HTTP/1.1 codec — a near-universal component of modern Java server stacks — and carries a CVSS v3.1 base score of 7.5 (High), with the entire impact concentrated in Availability.

Technical Analysis

Netty's HttpServerCodec is the standard inbound/outbound HTTP/1.1 codec used by a large portion of Java-based server frameworks, embedded servers, and API gateways. The HttpServerCodec combines an HttpRequestDecoder and HttpResponseEncoder into a single channel handler that parses HTTP/1.1 request bytes off the wire and enqueues decoded HttpRequest/HttpContent messages for downstream handlers.

The vulnerability is rooted in CWE-770 (Allocation of Resources Without Limits or Throttling). Per the NVD description, when a remote client pipelines HTTP/1.1 requests onto a single connection and withholds reads on the socket, the codec's methodOverflowQueue accumulates entries and is never bounded. Because the attacker does not consume the responses (the client read path is intentionally stalled), backpressure that would normally throttle the producer is never applied, allowing the queue to grow unbounded. Each enqueued entry retains heap-resident state, and the aggregate growth eventually exhausts the JVM heap.

Key technical characteristics, derived strictly from the supplied description:

• Attack surface: The HTTP/1.1 request-decoding path in HttpServerCodec, reachable by any unauthenticated client that can open a TCP connection to an exposed listener. No credentials, no special protocol negotiation, no UI interaction.
• Trigger mechanism (class-level): Resource exhaustion via request pipelining combined with a stalled read side — i.e., a slow-read / queue-fill DoS in the HTTP/1.1 parser's overflow buffering. This is closely related to the classic slowloris/slow-read family, but here the specific amplification vector is the methodOverflowQueue structure rather than connection-slot exhaustion.
• Impact mechanism: Unbounded heap allocation → heap pressure → GC thrashing → OutOfMemoryError → process/container termination. Recovery typically requires a JVM restart or container rescheduling.

Because no patch, no CVE-to-code diff, and no affected/fixed version range were published in the tracked sources, the precise trigger heuristics (exact HTTP method that causes overflow-queue entry, maximum request-line size that forces overflow) cannot be stated with certainty. The exploit is therefore best characterized by its vulnerability class: unauthenticated remote denial of service through unbounded queue growth under pipelined HTTP/1.1 load with suppressed reads.

Exploitation Scenarios

No public PoC, exploit code, Nuclei template, or CISA KEV entry exists for CVE-2026-93491. The following attack chain is inferred at the vulnerability-class level from the NVD description; no specific function names, code patterns, or hypothetical parameters are fabricated.

1. Reconnaissance / target identification An attacker identifies internet- or network-exposed HTTP/1.1 services backed by Netty. Because Netty commonly presents via Server headers, TLS certificate metadata, or application fingerprints (Spring WebFlux, gRPC-Web, Play, custom Netty servers), identification typically relies on banner/metadata correlation rather than a CVE-specific probe. Any TCP/80 or TCP/443 endpoint running a Netty-based HTTP listener is a candidate.

2. Triggering the specific flaw The attacker opens one or more TCP connections to the vulnerable listener and pipelines HTTP/1.1 requests — sending multiple requests back-to-back without waiting for responses. Critically, the attacker withholds reads on the socket, meaning the client's TCP receive buffer is never drained. This suppressed read removes the flow-control pressure that would ordinarily bound the producer side, allowing methodOverflowQueue inside HttpServerCodec to accumulate entries without limit.

3. Payload / execution method (class level) No crafted exploit payload is required beyond well-formed HTTP/1.1 request bytes. The attack is a traffic-shaping operation, not an injection: the malicious primitive is the pattern of pipelined requests paired with a non-reading client. Multiple concurrent connections multiply the per-connection queue growth and accelerate heap consumption.

4. Post-exploitation impact The growing methodOverflowQueue consumes heap linearly with the number of accepted requests. Once the JVM heap is exhausted, the process throws OutOfMemoryError and either terminates or becomes unresponsive to legitimate traffic. In a containerized deployment, the orchestrator may restart the container — the attacker simply reconnects, converting this into a persistent availability outage. No data confidentiality or integrity impact is described (CVSS C:N/I:N), so the impact is confined to denial of service.

Impact Assessment

• CVSS v3.1 base: 7.5 (High) — AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vector confirms a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction (UI:N) attack with full availability impact (A:H) and no stated confidentiality or integrity impact.
• Likely affected systems: Any JVM service embedding Netty's HTTP/1.1 server codec — Spring WebFlux/Reactor Netty applications, API gateways built on Netty, Netty-based proxies, gRPC-Web bridges, and custom Netty servers. Exact version range is not published; assume any such deployment without vendor guidance is at risk.
• Blast radius: A single successful connection/connection set can down one JVM instance. Because Netty often fronts high-traffic east-west and north-south API traffic, a downed gateway or service instance can cause cascading failures across dependent services. In autoscaled clusters, heap exhaustion can trigger repeated pod restarts (CrashLoopBackOff), amplifying outage scope and destabilizing the platform.
• Threat actor relevance: No named APT, ransomware, or hacktivist campaign has been tied to this CVE in the provided data. The low complexity and unauthenticated nature make it attractive to commodity DDoS operators and hacktivists; no exploit-in-the-wild evidence is currently available.
• Urgency modifiers: Patch confidence 0/4 (unpatched), no CISA KEV listing, no public PoC, and EPSS not yet scored by FIRST.org. Absence of EPSS/PoC does not reduce exposure — it reflects recency of scoring, not absence of risk.

Detection Guidance

Detection for this CVE is primarily behavioral and volumetric, since the malicious primitive is a legitimate-looking HTTP pattern (pipelined requests + stalled reads). The following rules target that pattern and the downstream heap-pressure symptoms. Tune thresholds to your baseline before alerting.

Sigma Rule

title: Potential Netty HttpServerCodec Heap Exhaustion DoS (CVE-2026-93491)
id: 8f2c1d4e-3b7a-4c9e-9a51-2f6d0c7e1a93
status: experimental
description: Detects JVM out-of-memory events and symptoms consistent with unbounded
  methodOverflowQueue growth in Netty HttpServerCodec via pipelined HTTP/1.1 requests.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93491
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026.93491
logsource:
  category: application
  product: java
detection:
  selection_oom:
    message|contains:
      - 'java.lang.OutOfMemoryError'
      - 'OutOfMemoryError: Java heap space'
      - 'Direct buffer memory'
  selection_netty:
    message|contains:
      - 'io.netty.handler.codec.http.HttpServerCodec'
      - 'methodOverflowQueue'
  condition: selection_oom and selection_netty
falsepositives:
  - Legitimate memory pressure from misconfigured heap sizing
  - Load-test or fuzzing environments
level: high

YARA Rule

rule CVE_2026_93491_Netty_HttpServerCodec_Queue_DoS
{
    meta:
        description = "Detects references to Netty HttpServerCodec methodOverflowQueue indicative of CVE-2026-93491 DoS exposure"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93491"
        cve = "CVE-2026-93491"

    strings:
        $codec  = "HttpServerCodec" ascii wide
        $queue  = "methodOverflowQueue" ascii wide
        $netty  = "io.netty.handler.codec.http" ascii wide

    condition:
        (uint32(0) == 0xCAFEBABE) and   // JVM class file magic
        $queue and ($codec or $netty)
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET [80,443,8080,8443] (msg:"CVE-2026-93491 Netty HttpServerCodec HTTP/1.1 pipelining DoS attempt"; flow:established,to_server; content:"HTTP/1.1"; http_header; pcre:"/^(GET|POST|PUT|HEAD|OPTIONS|DELETE|PATCH) /"; threshold:type both, track by_src, count 200, seconds 10; classtype:attempted-dos; reference:cve,2026-93491; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93491; sid:202693491; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where network.transport == "tcp" and destination.port in (80, 443, 8080, 8443)]
  [network where network.transport == "tcp" and destination.port in (80, 443, 8080, 8443)]
  [network where network.transport == "tcp" and destination.port in (80, 443, 8080, 8443)]

Note: deploy alongside a high-cardinality request counter on the same source.ip and a low egress/ack ratio to isolate stalled-read clients. EQL is best paired with a threshold rule for connection-to-request amplification.

Splunk SPL Query

index=web OR index=netflow sourcetype IN ("netty:access","java:app","suricata","zeek:http")
| where match(dest_port, "^(80|443|8080|8443)$")
| stats count AS req_count, dc(uri) AS distinct_uri, min(_time) AS first_seen, max(_time) AS last_seen BY src_ip, dest_ip
| eval window_sec = last_seen - first_seen
| where req_count > 500 AND window_sec < 30
| sort - req_count
| table src_ip dest_ip req_count distinct_uri window_sec first_seen last_seen

For direct OOM correlation, add: index=jvm_logs "OutOfMemoryError" AND "HttpServerCodec" and join on host.

Wazuh OSSEC Rule

<group name="netty,cve-2026-93491,web,">
  <rule id="100934" level="10">
    <decoded_as>json</decoded_as>
    <field name="log">OutOfMemoryError</field>
    <description>CVE-2026-93491: JVM heap exhaustion possibly caused by Netty HttpServerCodec unbounded methodOverflowQueue growth</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>availability_impact,</group>
  </rule>

  <rule id="100935" level="8">
    <decoded_as>json</decoded_as>
    <field name="log">methodOverflowQueue</field>
    <description>CVE-2026-93491: Netty HttpServerCodec methodOverflowQueue referenced under load - investigate for pipelining DoS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, no workaround, and no affected/fixed version metadata is present in any tracked source. Treat all Netty HttpServerCodec-based HTTP/1.1 listeners as exposed until authoritative guidance is published.

1. Immediate mitigations (compensating controls)

• Front with a reverse proxy / API gateway that normalizes client behaviour: Enforce per-connection request limits, disable or cap HTTP/1.1 pipelining, and terminate slow-reading clients. This directly removes the "withhold reads on pipelined requests" primitive, because the proxy consumes responses on the client's behalf and applies its own backpressure.
• Cap per-connection request rate and in-flight requests: Configure maxConnections, response write timeouts, and idle timeouts aggressively (e.g., short ReadTimeoutHandler/WriteTimeoutHandler, tight keep-alive limits). Wherever the server supports an explicit maximum outstanding-request or buffer bound, set it low.
• Bound the JVM heap and enable fast failover: Set realistic -Xmx, enable -XX:+HeapDumpOnOutOfMemoryError and container-aware memory limits, and ensure orchestrators restart unhealthy instances quickly. This limits outage duration but is not a fix.
• Network-layer throttling: Rate-limit connections and requests per source IP at the edge (WAF/CDN/load balancer) to blunt volumetric variants.
• Disable HTTP/1.1 pipelining support if configurable in your Netty-based framework; prefer HTTP/2 where the codec behaviour differs.

2. Patch / upgrade steps

• Monitor the Netty project's official release channels and security advisories for a fix addressing methodOverflowQueue boundaries (CVE-2026-93491). No fix version is available at time of writing.
• Request a CVE status and patched-version confirmation from the Netty maintainers / your framework vendor.
• Once a fix is published, upgrade the io.netty:netty-codec-http (and dependent) artifact to the fixed version, then rebuild and redeploy. Verify transitive dependency versions across all frameworks (Spring Boot/Reactor Netty, gRPC-Java, etc.) that shade or re-lock Netty.

3. Long-term hardening

• Maintain a software bill of materials (SBOM) and continuous dependency scanning so Netty and its shaded copies are inventoried and tracked against future advisories.
• Adopt defensive HTTP server configuration as standard: strict per-connection and per-client request caps, timeouts on reads and writes, and disabled pipelining/unconstrained keep-alive.
• Include availability-focused load and abuse testing (slow-read, pipelining bursts) in pre-production test suites.
• Instrument JVM heap, GC pause, and queue-depth metrics with alerting to detect early-stage resource exhaustion before OutOfMemoryError.

References

1. NVD — CVE-2026-93491: https://nvd.nist.gov/vuln/detail/CVE-2026-93491
2. MITRE CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
3. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. Netty Project (official repository / release notes — monitor for security advisory): https://github.com/netty/netty
5. FIRST.org EPSS (CVE score not yet published): https://www.first.org/epss/

Exploit-in-the-wild / threat actor note: No CISA KEV listing, no public PoC, no exploit code, and no named threat-actor campaign associated with CVE-2026-93491 are present in the available intelligence. EPSS has not yet scored this CVE. This report is based solely on the supplied NVD description and CVSS data; no additional technical specifics have been inferred beyond the documented vulnerability class.