CVE-2026-93492

Executive Summary

CVE-2026-93492 is a denial-of-service vulnerability in Netty's HTTP/2 HpackEncoder component. A remote, unauthenticated attacker can send HTTP/2 SETTINGS frames advertising an excessively large MAX_HEADER_TABLE_SIZE, forcing the encoder to retain an excessive number of unique header entries and driving up CPU and memory consumption until service availability degrades. Any internet-facing or internal service that uses Netty's HTTP/2 stack (gRPC endpoints, API gateways, reverse proxies, and similar long-lived HTTP/2 services) is potentially in scope. The vulnerability is currently unpatched, with no public proof-of-concept, no exploit code, no CISA KEV listing, and no EPSS score assigned.

Technical Analysis

HTTP/2 implements header compression via HPACK (RFC 7541). A core HPACK concept is the dynamic table — a per-connection, per-direction cache of previously seen header fields that both peers use to compress subsequent messages by referencing table indices instead of resending full header names and values. The maximum size of the decoder's dynamic table is a tunable parameter that each endpoint communicates to its peer through the HTTP/2 SETTINGS frame, specifically the SETTINGS_HEADER_TABLE_SIZE parameter. A sender's encoder must respect the peer's advertised maximum when deciding how many entries to insert into its own dynamic table.

The flaw described in the NVD entry affects Netty's HpackEncoder. Per the description, a remote attacker can send HTTP/2 SETTINGS frames that advertise a very large MAX_HEADER_TABLE_SIZE. When the peer's advertised table size is large, the encoder can legally insert an excessive number of unique header fields into its dynamic table. Because each unique header must be stored and indexed, memory consumption grows, and the act of inserting and indexing an ever-growing set of unique entries drives additional CPU cost per operation.

The attack class is a classic resource-exhaustion denial of service (CWE-1035, an attack-technique-style weakness mapping focused on resource consumption / amplification). The distinguishing characteristic here is that the trigger is not a malformed packet or a parser crash, but a legitimate protocol negotiation combined with a client-controlled resource ceiling. The encoder behaves exactly as HPACK permits — the problem is that its resource consumption is bounded by an attacker-supplied value rather than by an internal hard cap or a runtime budget.

Attack surface: any Netty-based endpoint that speaks HTTP/2 and therefore instantiates HpackEncoder. This includes servers, clients, and proxies built on Netty's HTTP/2 codec. The SETTINGS frame is part of the mandatory HTTP/2 connection preface exchange, meaning the attacker needs only to complete a TCP connection and initiate HTTP/2 negotiation — no authentication, no application-layer session, no valid request payload.

Note on scope of this analysis: the supplied NVD description names the affected class (HpackEncoder), the mechanism (SETTINGS frames with large MAX_HEADER_TABLE_SIZE), and the consequence (excessive unique-header storage, high CPU and memory, DoS). It does not disclose the specific Netty version range, the exact code path within HpackEncoder, or any configuration constants. Those details are marked as unavailable and are not inferred here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the mechanism stated in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a service that negotiates HTTP/2 and is likely built on Netty — for example via TLS ALPN negotiation advertising h2, an HTTP/2 upgrade (h2c) response, or fingerprinting of Netty-specific error pages, header ordering, and connection behavior. Broadly deployed Netty-based services (gRPC servers, API gateways, service meshes, streaming endpoints) are the natural targets.

2. Triggering the flaw class. The attacker establishes a TCP connection and begins the HTTP/2 handshake. During SETTINGS exchange, the attacker advertises an unusually large SETTINGS_HEADER_TABLE_SIZE value, directing the server's HpackEncoder to permit a very large dynamic table. This is the resource-ceiling manipulation at the heart of the flaw.

3. Execution at the vulnerability-class level. The attacker then sends HTTP/2 traffic composed of many unique header fields (distinct header names and/or values that cannot be deduplicated against existing table entries). Because the encoder's permitted table size has been inflated and the fields are unique, each field is retained and indexed rather than evicted, growing the dynamic table and increasing per-frame CPU work and memory footprint. Repeating this across one or many concurrent connections amplifies the effect. No specific method names, frame payloads, or code patterns are asserted here beyond what the NVD description states.

4. Post-exploitation impact. Rising CPU and memory consumption degrade response latency and throughput for legitimate clients. Under sufficient load — one aggressive connection or many parallel connections — the process may become unresponsive, exhaust heap, or be terminated by resource limits, resulting in a denial of service. The CVSS vector (C:N/I:N/A:L) indicates no confidentiality or integrity loss and a low availability impact in the base score, but real-world impact scales with concurrency and deployment topology.

Impact Assessment

• Confidentiality / Integrity: None (C:N, I:N). The flaw does not disclose or modify data; it consumes resources.
• Availability: Low per the CVSS base (A:L), meaning a single instance of the attack produces limited degradation. In practice, availability impact is amplifiable: unauthenticated attackers (AV:N, PR:N, UI:N) can scale the attack across concurrent connections to drive CPU/memory exhaustion well beyond a "low" single-shot effect. AC:L means no special conditions are required to attempt it.
• Blast radius: Any component in a service graph that terminates or originates HTTP/2 via Netty. Because Netty underpins many higher-level frameworks (RPC, gateways, proxies), a single vulnerable library version can affect numerous downstream services. A degraded HTTP/2 front end can cascade into latency and timeouts for all dependent services.
• Business impact: Service unavailability for HTTP/2-dependent APIs, elevated infrastructure costs during attack (autoscaling), and potential SLA breaches. No data-breach or regulatory exposure is implied by the vector.

Detection Guidance

Sigma Rule

title: Possible Netty HTTP/2 HpackEncoder Resource-Exhaustion Attempt (CVE-2026-93492)
id: 7c9b1a42-3e5d-4f8a-9b21-8d4f0c6e1a77
status: experimental
description: Detects HTTP/2 connections advertising an abnormally large SETTINGS_HEADER_TABLE_SIZE, consistent with CVE-2026-93492 HpackEncoder resource exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93492
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_h2:
    proto: 'HTTP/2'
  selection_settings:
    settings_header_table_size|gte: 65536
  condition: selection_h2 and selection_settings
  timeframe: 5m
fields:
  - src_ip
  - dst_ip
  - settings_header_table_size
falsepositives:
  - Legitimate large-table clients (rare)
  - Load test tools and proxies configured with large HPACK tables
level: medium
tags:
  - attack.t1499
  - cve.2026.93492

YARA Rule

rule CVE_2026_93492_Netty_HPACK_LargeTable
{
    meta:
        author      = "valtersit.com"
        description = "Flags network captures or artifacts containing an HTTP/2 SETTINGS_HEADER_TABLE_SIZE value far above normal, indicative of CVE-2026-93492 Netty HpackEncoder abuse."
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-93492"
        date        = "2026-01-01"
        cve         = "CVE-2026-93492"

    strings:
        // HTTP/2 client connection preface
        $preface = "PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n"

    condition:
        $preface
}

Note: YARA operates on files/memory, not live network streams; this rule only flags on-host artifacts (e.g., PCAP or log files) that contain the HTTP/2 connection preface. Deeper SETTINGS parsing is best handled by Suricata/Zeek.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-93492 Netty HTTP/2 HpackEncoder suspicious SETTINGS_HEADER_TABLE_SIZE"; flow:established,to_server; content:"|00 00|"; depth:2; byte_test:1,=,4,2; content:"|00 04|"; offset:2; depth:2; content:"|00 00|"; within:2; byte_test:4,>,65535,0,relative; sid:202693492; rev:1; reference:cve,2026-93492; metadata:service http2; classtype:attempted-dos;)

This rule matches an HTTP/2 SETTINGS frame (type 0x04) carrying a SETTINGS_HEADER_TABLE_SIZE (identifier 0x0004) with a value above 65535. Validate and tune offsets against your sensor before deployment.

Elastic Detection

sequence by process.entity_id with maxspan=2m
  [ network where network.protocol == "http2" and http2.settings.header_table_size >= 65536 ]
  [ network where network.protocol == "http2" and http2.frame.type == "HEADERS" ]

Requires HTTP/2 field extraction or a protocol-aware ingest pipeline. If those fields are unavailable, approximate by correlating long-lived HTTP/2 connections with rising process memory.

Splunk SPL Query

index=network sourcetype=http2 OR sourcetype=zeek:http2
| search settings_header_table_size >= 65536
| stats count AS hits, sum(bytes_out) AS bytes, dc(dest_ip) AS targets BY src_ip, dest_ip, settings_header_table_size
| where hits > 5
| sort - hits
| table src_ip dest_ip settings_header_table_size hits bytes targets

Adjust index/sourcetype/field names to your schema; the detection intent is an abnormally large advertised header-table size from a single source to one or more destinations.

Wazuh OSSEC Rule

<group name="netty_cve_2026_93492,http2,dos,">
  <rule id="2026934" level="8">
    <decoded_as>json</decoded_as>
    <field name="network.protocol">http2</field>
    <field name="http2.settings.header_table_size" type="pcre2">^[6-9][0-9]{4,}$</field>
    <description>CVE-2026-93492: HTTP/2 peer advertised abnormally large SETTINGS_HEADER_TABLE_SIZE, possible Netty HpackEncoder resource-exhaustion attempt.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_93492,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source.

1. Immediate mitigations (compensating controls):

   • Cap the accepted HTTP/2 header table size at the boundary. Deploy a front-end HTTP/2 proxy or load balancer that rejects or clamps SETTINGS_HEADER_TABLE_SIZE values above a sane maximum before traffic reaches Netty-based backends.
   • Enforce connection and resource limits. Cap concurrent HTTP/2 connections per source IP, limit request/frame rates, and set strict CPU and heap ceilings on Netty processes to contain blast radius.
   • Rate-limit and throttle. Apply connection-rate limits at the edge to blunt amplification via many concurrent connections.
   • Monitoring. Alert on HTTP/2 connections advertising header-table sizes above expected baselines and on sustained CPU/heap growth correlated with long-lived HTTP/2 sessions.

2. Patch/upgrade steps: No vendor fix, advisory, or patched version is documented in the supplied data. Operators should monitor the Netty project's security announcements and the NVD entry for CVE-2026-93492 and apply an official release as soon as one is published. Do not deploy unverified third-party patches or forks.

3. Long-term hardening:

   • Pin and track the Netty version used across all services; maintain an SBOM so affected HpackEncoder consumers can be located quickly.
   • Standardize edge enforcement of HTTP/2 SETTINGS bounds so a future encoder flaw cannot be reached with attacker-chosen limits.
   • Adopt resource-budget tests (CPU/memory under adversarial SETTINGS) as part of change validation for HTTP/2 services.

References

• NVD — CVE-2026-93492: https://nvd.nist.gov/vuln/detail/CVE-2026-93492
• Netty project (monitor for security advisories and fixed releases): https://netty.io/
• RFC 7541 — HPACK: Header Compression for HTTP/2 (dynamic table and SETTINGS_HEADER_TABLE_SIZE semantics): https://www.rfc-editor.org/rfc/rfc7541
• RFC 9113 — HTTP/2 (SETTINGS frame definition): https://www.rfc-editor.org/rfc/rfc9113
• CWE-1035 — resource-consumption / amplification weakness class: https://cwe.mitre.org/

Threat actor / exploit-in-the-wild evidence: None. No public PoC, no exploit code, no Nuclei template, no CISA KEV listing, and no campaign attribution is present in the supplied data. EPSS has not yet scored this CVE. No fabrication of in-the-wild activity is warranted at this time.