A vulnerability in Netty's HttpServerCodec allows a remote unauthenticated attacker to cause unbounded heap memory consumption by pipelining HTTP/1.1 requests and withholding reads. This leads to denial of service due to memory exhaustion. The issue is tracked as CVE-2026-93491 with a high severity score of 7.5. Red Hat has issued an important security advisory including updates for related components in their Quarkus build, indicating that fixes are available.