What’s Vulnerable › Vulnerabilities

CVE-2026-93492: Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-18 · updated 2026-10-16
• Weakness: CWE-1035

Description

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).

Affected products

• Red Hat build of Keycloak 26.4: all versions
• Red Hat build of Apache Camel 4 for Quarkus 3: all versions
• Red Hat build of Apache Camel for Spring Boot 4: all versions
• Red Hat build of Apicurio Registry 3: all versions
• Red Hat Data Grid 8: all versions
• Red Hat JBoss Enterprise Application Platform Expansion Pack: all versions

References

• https://access.redhat.com/errata/RHSA-2026:69440
• https://access.redhat.com/errata/RHSA-2026:69470
• https://access.redhat.com/errata/RHSA-2026:83612
• https://access.redhat.com/security/cve/CVE-2026-93492
• https://bugzilla.redhat.com/show_bug.cgi?id=2536895

Get alerted when CVE-2026-93492 or the next vulnerability affects your stack