CVE-2026-93488

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93488

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93488.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-93488

Downstream

Related

Published

2026-09-18T11:47:52Z

Modified

2026-10-17T02:31:35Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

Details

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.

Database specific

{
    "cna_assigner": "redhat",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93488.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "4.1.138.Final-redhat-00001"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "InverseAffectedRanges"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/netty/netty

Affected ranges

Type

GIT

Repo

https://github.com/netty/netty

Events

Introduced

Fixed

26e68a2c3935e459b374891c87760f6d6c5e2550

Fixed

2521f494432e27415a567d3a81a9eb907abf20b3

Database specific

Show details

{
    "extracted_events": [
        {
            "original_tag": "netty-4.1.138.Final",
            "range": [
                {
                    "fixed": "26e68a2c3935e459b374891c87760f6d6c5e2550"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "netty-4.2.18.Final",
            "range": [
                {
                    "fixed": "2521f494432e27415a567d3a81a9eb907abf20b3"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

netty-4.*

netty-4.0.0.Alpha1

netty-4.0.0.Alpha2

netty-4.0.0.Alpha3

netty-4.0.0.Alpha4

netty-4.0.0.Alpha5

netty-4.0.0.Alpha6

netty-4.0.0.Alpha7

netty-4.0.0.Alpha8

netty-4.0.0.Beta1

netty-4.0.0.Beta2

netty-4.0.0.Beta3

netty-4.0.0.CR1

netty-4.0.0.CR2

netty-4.0.0.CR3

netty-4.0.0.CR4

netty-4.0.0.CR5

netty-4.0.0.CR7

netty-4.0.0.CR8

netty-4.0.0.CR9

netty-4.0.0.Final

netty-4.0.1.Final

netty-4.0.10.Final

netty-4.0.11.Final

netty-4.0.12.Final

netty-4.0.13.Final

netty-4.0.14.Beta1

netty-4.0.14.Final

netty-4.0.15.Final

netty-4.0.2.Final

netty-4.0.3.Final

netty-4.0.4.Final

netty-4.0.5.Final

netty-4.0.6.Final

netty-4.0.7.Final

netty-4.0.8.Final

netty-4.1.0.Beta1

netty-4.1.0.Beta2

netty-4.1.0.Beta3

netty-4.1.0.Beta4

netty-4.1.0.Beta5

netty-4.1.0.Beta6

netty-4.1.0.Beta7

netty-4.1.0.Beta8

netty-4.1.0.CR1

netty-4.1.0.CR2

netty-4.1.0.CR3

netty-4.1.0.CR4

netty-4.1.0.CR5

netty-4.1.0.CR6

netty-4.1.0.CR7

netty-4.1.0.Final

netty-4.1.1.Final

netty-4.1.10.Final

netty-4.1.100.Final

netty-4.1.101.Final

netty-4.1.102.Final

netty-4.1.103.Final

netty-4.1.104.Final

netty-4.1.105.Final

netty-4.1.106.Final

netty-4.1.107.Final

netty-4.1.108.Final

netty-4.1.109.Final

netty-4.1.11.Final

netty-4.1.110.Final

netty-4.1.111.Final

netty-4.1.112.Final

netty-4.1.113.Final

netty-4.1.114.Final

netty-4.1.115.Final

netty-4.1.116.Final

netty-4.1.117.Final

netty-4.1.118.Final

netty-4.1.119.Final

netty-4.1.12.Final

netty-4.1.120.Final

netty-4.1.121.Final

netty-4.1.122.Final

netty-4.1.123.Final

netty-4.1.124.Final

netty-4.1.125.Final

netty-4.1.126.Final

netty-4.1.127.Final

netty-4.1.128.Final

netty-4.1.129.Final

netty-4.1.13.Final

netty-4.1.130.Final

netty-4.1.131.Final

netty-4.1.132.Final

netty-4.1.133.Final

netty-4.1.134.Final

netty-4.1.135.Final

netty-4.1.136.Final

netty-4.1.137.Final

netty-4.1.14.Final

netty-4.1.15.Final

netty-4.1.16.Final

netty-4.1.17.Final

netty-4.1.18.Final

netty-4.1.19.Final

netty-4.1.2.Final

netty-4.1.20.Final

netty-4.1.21.Final

netty-4.1.22.Final

netty-4.1.23.Final

netty-4.1.24.Final

netty-4.1.25.Final

netty-4.1.26.Final

netty-4.1.27.Final

netty-4.1.28.Final

netty-4.1.29.Final

netty-4.1.3.Final

netty-4.1.30.Final

netty-4.1.31.Final

netty-4.1.32.Final

netty-4.1.33.Final

netty-4.1.34.Final

netty-4.1.35.Final

netty-4.1.36.Final

netty-4.1.37.Final

netty-4.1.38.Final

netty-4.1.39.Final

netty-4.1.4.Final

netty-4.1.40.Final

netty-4.1.41.Final

netty-4.1.42.Final

netty-4.1.43.Final

netty-4.1.44.Final

netty-4.1.45.Final

netty-4.1.46.Final

netty-4.1.47.Final

netty-4.1.48.Final

netty-4.1.49.Final

netty-4.1.5.Final

netty-4.1.50.Final

netty-4.1.51.Final

netty-4.1.52.Final

netty-4.1.53.Final

netty-4.1.54.Final

netty-4.1.55.Final

netty-4.1.56.Final

netty-4.1.57.Final

netty-4.1.58.Final

netty-4.1.59.Final

netty-4.1.6.Final

netty-4.1.60.Final

netty-4.1.61.Final

netty-4.1.62.Final

netty-4.1.63.Final

netty-4.1.64.Final

netty-4.1.65.Final

netty-4.1.66.Final

netty-4.1.67.Final

netty-4.1.68.Final

netty-4.1.69.Final

netty-4.1.7.Final

netty-4.1.70.Final

netty-4.1.71.Final

netty-4.1.72.Final

netty-4.1.73.Final

netty-4.1.74.Final

netty-4.1.75.Final

netty-4.1.76.Final

netty-4.1.77.Final

netty-4.1.78.Final

netty-4.1.79.Final

netty-4.1.8.Final

netty-4.1.80.Final

netty-4.1.81.Final

netty-4.1.82.Final

netty-4.1.83.Final

netty-4.1.84.Final

netty-4.1.85.Final

netty-4.1.86.Final

netty-4.1.87.Final

netty-4.1.88.Final

netty-4.1.89.Final

netty-4.1.9.Final

netty-4.1.90.Final

netty-4.1.91.Final

netty-4.1.92.Final

netty-4.1.93.Final

netty-4.1.94.Final

netty-4.1.95.Final

netty-4.1.96.Final

netty-4.1.97.Final

netty-4.1.98.Final

netty-4.1.99.Final

netty-4.2.0.Alpha1

netty-4.2.0.Alpha2

netty-4.2.0.Alpha3

netty-4.2.0.Alpha4

netty-4.2.0.Alpha5

netty-4.2.0.Beta1

netty-4.2.0.Final

netty-4.2.0.RC1

netty-4.2.0.RC2

netty-4.2.0.RC3

netty-4.2.0.RC4

netty-4.2.1.Final

netty-4.2.10.Final

netty-4.2.11.Final

netty-4.2.12.Final

netty-4.2.13.Final

netty-4.2.14.Final

netty-4.2.15.Final

netty-4.2.16.Final

netty-4.2.17.Final

netty-4.2.2.Final

netty-4.2.3.Final

netty-4.2.4.Final

netty-4.2.5.Final

netty-4.2.6.Final

netty-4.2.7.Final

netty-4.2.8.Final

netty-4.2.9.Final

Other

netty-clang-bin

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93488.json"