CVE-2026-93491 is a denial of service vulnerability in Netty's HttpServerCodec. The vulnerability arises when an attacker pipelines HTTP/1.1 requests on a single connection and withholds reading responses, causing the methodOverflowQueue to grow without limit. This unbounded queue growth leads to unbounded heap memory consumption, resulting in memory exhaustion and denial of service. The issue affects multiple specific Netty versions as listed. Red Hat's advisory confirms the absence of an effective mitigation or fix that meets their criteria at this time.

Exploitation of this vulnerability allows a remote, unauthenticated attacker to cause unbounded memory consumption on affected systems, leading to denial of service due to memory exhaustion. There is no impact on confidentiality or integrity, but availability is significantly affected.

Currently, no mitigation or official fix meeting Red Hat's criteria for ease of use, deployment, applicability, or stability is available. Users are advised to monitor vendor advisories for updates and consider upgrading to fixed versions when they become available. Applying mitigations or workarounds is not currently feasible per Red Hat's assessment.