CVE-2026-93558: Uncontrolled Resource Consumption

September 18, 2026 (updated October 8, 2026)

A flaw was found in Netty’s WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.

References

bugzilla.redhat.com/show_bug.cgi?id=2536932
github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc
nvd.nist.gov/vuln/detail/CVE-2026-93558

Code Behaviors & Features

Detect and mitigate CVE-2026-93558 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →