CVE-2026-93492: Netty HTTP/2 HpackEncoder DoS Vulnerability

CVE-2026-93492 Overview

CVE-2026-93492 is a Denial of Service (DoS) vulnerability in the Netty HTTP/2 HpackEncoder. A remote attacker can send HTTP/2 SETTINGS frames with an oversized MAX_HEADER_TABLE_SIZE value. The encoder then stores an excessive number of unique headers, exhausting CPU and memory resources on the target server. The flaw maps to [CWE-1035] and impacts availability without requiring authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can exhaust server CPU and memory by manipulating HPACK dynamic table sizing, causing service disruption for any Netty-based HTTP/2 endpoint.

Affected Products

Netty HTTP/2 implementation (HpackEncoder component)
Red Hat products shipping Netty (see RHSA-2026:69440)
Red Hat products shipping Netty (see RHSA-2026:69470)

Discovery Timeline

2026-09-18 - CVE-2026-93492 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-93492

Vulnerability Analysis

The vulnerability resides in Netty's HTTP/2 HpackEncoder, which implements HPACK header compression as defined by RFC 7541. HPACK relies on a dynamic table shared between peers to compress repeated header fields. The SETTINGS_HEADER_TABLE_SIZE parameter, sent in an HTTP/2 SETTINGS frame, controls the maximum size of that table.

When a remote client sends a SETTINGS frame containing a very large MAX_HEADER_TABLE_SIZE, the HpackEncoder accepts the value and expands the dynamic table accordingly. An attacker can then submit large volumes of unique headers, forcing the encoder to store each entry. Sustained abuse drives CPU consumption during table maintenance and grows heap allocation until the server degrades or becomes unresponsive.

The attack requires no authentication and can be launched over any exposed HTTP/2 endpoint, including reverse proxies, application servers, and API gateways built on Netty.

Root Cause

The root cause is missing enforcement of a safe upper bound on the peer-advertised header table size. Netty honors the client-supplied MAX_HEADER_TABLE_SIZE without applying a defensive ceiling, allowing unbounded resource allocation inside the encoder's dynamic table.

Attack Vector

An attacker establishes an HTTP/2 connection to a Netty-based server and sends a SETTINGS frame advertising an inflated MAX_HEADER_TABLE_SIZE. The attacker then issues requests with many unique header names and values. The encoder inserts each entry into the dynamic table, consuming memory and CPU cycles proportional to the flood of unique headers.

The vulnerability manifests through standard protocol behavior. No malformed frames or exploit payloads are required. Refer to the Red Hat CVE-2026-93492 Details advisory for additional technical context.

Detection Methods for CVE-2026-93492

Indicators of Compromise

HTTP/2 SETTINGS frames containing unusually large SETTINGS_HEADER_TABLE_SIZE values from external clients.
Sustained heap growth and elevated CPU usage in Java processes running Netty-based services.
Spikes in unique header names or values per connection in HTTP/2 access logs.
OutOfMemoryError events or garbage collection storms in application logs correlated with HTTP/2 traffic bursts.

Detection Strategies

Inspect HTTP/2 frame telemetry at the load balancer or ingress layer for anomalous SETTINGS_HEADER_TABLE_SIZE values.
Correlate JVM memory and CPU metrics with per-connection HTTP/2 header cardinality to identify abusive clients.
Baseline normal header table size negotiations and alert on deviations that exceed operational norms.

Monitoring Recommendations

Enable HTTP/2 protocol logging on reverse proxies and API gateways fronting Netty services.
Track heap_used, gc_pause_time, and thread CPU time on JVM services and alert on sustained increases.
Monitor connection-level metrics for header count and total header bytes per HTTP/2 stream.

How to Mitigate CVE-2026-93492

Immediate Actions Required

Apply the Netty updates delivered through RHSA-2026:69440 and RHSA-2026:69470 or the equivalent upstream Netty release.
Inventory all services embedding Netty, including Spring WebFlux, Micronaut, Vert.x, gRPC, and Reactor Netty deployments.
Rate-limit HTTP/2 connections at the edge and restrict header-heavy traffic from untrusted sources.

Patch Information

Red Hat has released fixed packages through security advisories RHSA-2026:69440 and RHSA-2026:69470. Additional tracking details are available in Red Hat Bug #2536895. Upgrade Netty to the patched version referenced by these advisories.

Workarounds

Terminate HTTP/2 at a reverse proxy that enforces a safe upper bound on SETTINGS_HEADER_TABLE_SIZE.
Configure per-connection limits on request rate, header count, and total header size on ingress controllers.
Restrict HTTP/2 exposure to trusted clients through network segmentation or mutual TLS where feasible.

bash

# Configuration example - refer to vendor advisories for authoritative guidance
# Upgrade Netty via package manager after applying RHSA-2026:69440 / RHSA-2026:69470
sudo dnf update netty