CVE-2026-93488: Netty SPDY Memory Exhaustion DoS Vulnerability

CVE-2026-93488 Overview

CVE-2026-93488 is a denial-of-service vulnerability in the Netty asynchronous networking framework. The flaw resides in the SpdySessionHandler, which accepts an unlimited number of concurrent remote-initiated SPDY streams. The internal localConcurrentStreams limit defaults to Integer.MAX_VALUE, and Netty exposes no public API to reduce it. A remote peer can open a SPDY connection and send a flood of SYN_STREAM frames with FLAG_FIN=0, forcing the server to allocate unbounded heap and direct memory until the JVM throws OutOfMemoryError. The issue is tracked under [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
A single unauthenticated remote attacker can exhaust JVM memory on any Netty-based service exposing SPDY, resulting in service crash and denial of service.

Affected Products

Netty versions prior to 4.1.138.Final
Netty versions prior to 4.2.18.Final
Red Hat products bundling vulnerable Netty releases (see RHSA-2026:69440, RHSA-2026:69470, RHSA-2026:70257)

Discovery Timeline

2026-09-18 - CVE-2026-93488 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93488

Vulnerability Analysis

The SPDY protocol multiplexes multiple logical streams over a single TCP connection. Each stream carries state that must be tracked by the endpoint until the stream is closed. Netty's SpdySessionHandler maintains this state in an in-memory session table.

The handler enforces a cap on concurrent remote-initiated streams through the localConcurrentStreams field. In vulnerable releases this field is initialized to Integer.MAX_VALUE and cannot be lowered through any exposed configuration method. Every inbound SYN_STREAM frame that keeps the stream open (FLAG_FIN=0) adds a new entry to the session table and reserves buffers for future frames.

Because the cap is effectively infinite and no back-pressure is applied, a remote peer can stream SYN_STREAM frames continuously. Heap objects, direct byte buffers, and stream metadata accumulate until the JVM exhausts memory. The process then terminates with OutOfMemoryError, taking down every application hosted in the same JVM.

Root Cause

The root cause is a missing resource limit. Netty declared the localConcurrentStreams field but neither enforced a sane default nor allowed operators to override it. This maps directly to [CWE-770] Allocation of Resources Without Limits or Throttling.

Attack Vector

The attack requires only network reachability to a service that exposes a SPDY listener built on Netty. No authentication or user interaction is required. An attacker opens a TCP or TLS session, negotiates SPDY, and then transmits a high volume of SYN_STREAM frames without terminating any of them. Memory consumption grows linearly with the number of frames until the JVM crashes.

No verified public exploit code is available. The exploitation pattern is described in the Red Hat CVE record for CVE-2026-93488 and the Red Hat Bugzilla report.

Detection Methods for CVE-2026-93488

Indicators of Compromise

Sustained growth in JVM heap and direct memory metrics on services exposing SPDY listeners.
JVM logs containing java.lang.OutOfMemoryError correlated with active SPDY sessions.
Single remote peers opening large numbers of streams on one connection without sending FLAG_FIN=1.
Repeated Netty pipeline errors originating from io.netty.handler.codec.spdy.SpdySessionHandler.

Detection Strategies

Inventory Java services for the presence of netty-codec-http or netty-codec-spdy at versions below 4.1.138.Final or 4.2.18.Final.
Enable protocol-aware logging on load balancers and reverse proxies to record SPDY stream counts per client.
Alert on abnormal ratios of opened versus closed SPDY streams over a rolling window.

Monitoring Recommendations

Instrument JVM applications with heap, direct memory, and GC pause metrics exported to a centralized platform.
Monitor process restarts and crash dumps on hosts running Netty-based services.
Track network connections sending high-frequency small frames to SPDY ports for triage.

How to Mitigate CVE-2026-93488

Immediate Actions Required

Upgrade Netty to 4.1.138.Final or 4.2.18.Final or later on all affected services.
Apply the Red Hat updates in RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257 where applicable.
Restart JVM processes after upgrade to load the patched classes.
Audit dependency trees to identify transitive Netty inclusions in application archives.

Patch Information

Fixed releases are available on GitHub: Netty 4.1.138.Final and Netty 4.2.18.Final. Red Hat consumers should apply the corresponding RHSA errata bundled with their platform.

Workarounds

Disable SPDY protocol negotiation where it is not required by clients.
Terminate TLS and protocol negotiation at a reverse proxy that does not offer SPDY.
Enforce per-connection stream and rate limits at an upstream load balancer.
Restrict network exposure of SPDY endpoints to trusted client ranges until patching completes.

bash

# Configuration example: verify Netty version in a Maven project
mvn dependency:tree | grep -E 'netty-(codec|handler|all)'

# Enforce upgrade via Maven dependencyManagement
# <dependencyManagement>
#   <dependencies>
#     <dependency>
#       <groupId>io.netty</groupId>
#       <artifactId>netty-bom</artifactId>
#       <version>4.1.138.Final</version>
#       <type>pom</type>
#       <scope>import</scope>
#     </dependency>
#   </dependencies>
# </dependencyManagement>