CVE-2026-93558: Netty WebSocketServerExtensionHandler DoS

CVE-2026-93558 Overview

CVE-2026-93558 is a denial of service vulnerability in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit the flaw by using HTTP/1.1 pipelining to send requests faster than the application can respond. The handler enqueues these requests on a per-connection queue that has no upper bound. Sustained pipelining causes the queue to grow indefinitely, consuming heap memory until the Java Virtual Machine (JVM) exhausts available memory. The resulting OutOfMemoryError disrupts service availability on any application built on Netty that uses the WebSocket server extension handler.

Critical Impact
Unauthenticated network attackers can exhaust JVM heap memory on Netty-based servers, causing service outages without valid credentials or user interaction.

Affected Products

Netty WebSocketServerExtensionHandler component
Red Hat products shipping affected Netty builds (see RHSA-2026:69440, RHSA-2026:69470, RHSA-2026:70257)
Java applications and middleware that embed vulnerable Netty releases

Discovery Timeline

2026-09-18 - CVE-2026-93558 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93558

Vulnerability Analysis

The flaw is a resource exhaustion issue [CWE-1035] in the WebSocket server extension handling pipeline. Netty processes inbound HTTP requests through a chain of channel handlers. WebSocketServerExtensionHandler inspects each request for WebSocket extension negotiation headers and defers writing the response until upstream handlers complete processing.

When a client uses HTTP/1.1 pipelining, multiple requests are sent on the same connection before the server responds to prior ones. The handler tracks pending requests in a per-connection queue to preserve response ordering. That queue has no size limit or backpressure mechanism. An attacker that sends pipelined requests faster than the server can process them causes unbounded queue growth, which retains references to request objects and prevents garbage collection.

Memory pressure accumulates until the JVM raises OutOfMemoryError, halting request processing across all connections served by the same process. The attack requires no authentication and no user interaction.

Root Cause

The root cause is missing capacity enforcement on the internal queue used by WebSocketServerExtensionHandler to preserve HTTP response ordering during pipelined request handling. Without a bounded queue or flow-control policy, request arrival rate is decoupled from processing throughput.

Attack Vector

Exploitation requires only network access to an HTTP endpoint served by a vulnerable Netty build. The attacker opens a TCP connection, sends a high volume of pipelined HTTP/1.1 requests that traverse the WebSocket extension handler, and keeps the connection open. The technical details of the queue growth pattern are documented in the Red Hat CVE Analysis for CVE-2026-93558 and the associated Red Hat Bug Report #2536932.

Detection Methods for CVE-2026-93558

Indicators of Compromise

Sudden rise in JVM heap usage on Netty-based services followed by java.lang.OutOfMemoryError: Java heap space entries in application logs.
Single client IP addresses opening long-lived TCP connections with sustained inbound HTTP/1.1 request rates and no matching response traffic.
Growth in Netty ChannelHandlerContext object counts observed through JVM heap dumps or profiler snapshots.

Detection Strategies

Monitor JVM garbage collection metrics for rising old-generation occupancy and increasing full GC frequency on services embedding Netty.
Inspect HTTP access logs for connections issuing many pipelined requests without corresponding response completions.
Correlate network flow telemetry with application memory metrics to identify pipelining-based traffic patterns preceding memory saturation.

Monitoring Recommendations

Configure alerts on OutOfMemoryError events and abnormal heap growth rates in application performance monitoring tools.
Track per-connection request queue depth if the Netty version exposes it through metrics or Micrometer bindings.
Enable network flow logging at load balancers and reverse proxies to attribute pipelined request bursts to source addresses.

How to Mitigate CVE-2026-93558

Immediate Actions Required

Apply the vendor patches referenced in RHSA-2026:69440, RHSA-2026:69470, and RHSA-2026:70257 to affected Red Hat products.
Inventory Java applications for embedded Netty dependencies and upgrade to a fixed release from your distribution or the upstream project.
Restart affected JVM processes after patching to clear any accumulated queue state.

Patch Information

Red Hat has released fixes for affected products through the errata listed above. Consult the Red Hat CVE Analysis for CVE-2026-93558 for the authoritative list of impacted packages and fixed versions. Application owners using Netty directly should upgrade to the patched upstream release referenced in that advisory.

Workarounds

Terminate HTTP/1.1 pipelining at an upstream reverse proxy or load balancer that enforces per-connection request queue limits.
Apply per-source-IP rate limiting and connection concurrency limits at the network edge to constrain request arrival rates.
Reduce JVM idle connection timeouts so that abusive long-lived connections are closed before queues grow beyond safe thresholds.

bash

# Configuration example - NGINX reverse proxy limiting request rate and connections per client
http {
    limit_req_zone $binary_remote_addr zone=netty_rl:10m rate=20r/s;
    limit_conn_zone $binary_remote_addr zone=netty_cc:10m;

    server {
        listen 443 ssl http2;
        server_name app.example.com;

        location / {
            limit_req  zone=netty_rl burst=40 nodelay;
            limit_conn netty_cc 10;
            proxy_pass http://netty_backend;
            proxy_http_version 1.1;
            proxy_request_buffering on;
        }
    }
}