This vulnerability arises from an unbounded queue in Netty's HttpServerCodec that tracks pipelined HTTP/1.1 requests. A remote attacker can exploit this by sending multiple pipelined requests without reading responses, causing the methodOverflowQueue to grow without limit. This results in unbounded heap memory consumption and denial of service due to memory exhaustion in applications using affected Netty versions, including Red Hat AMQ Broker 7. Red Hat has published an advisory confirming the issue but currently does not offer a mitigation or fix that meets their standards for ease of use, applicability, or stability.

The vulnerability allows a remote, unauthenticated attacker to cause denial of service by exhausting heap memory through unbounded resource allocation. This leads to potential service unavailability in affected applications. There is no impact on confidentiality or integrity, only availability is affected.

Red Hat currently states that no mitigation is available or that existing options do not meet their criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Applying a fix is not currently possible; consider contacting Red Hat Technical Account Managers if applicable. Avoid exposure of vulnerable services to untrusted networks where possible.