← Vulnerability feed

Vulnerability record · CVE-2026-93488 · published 18 September 2026

CVE-2026-93488: Allocation without limits vulnerability

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.

7.5 CVSS 3.1 High EPSS 0.70% · top 48.8% CWE-770 · Allocation without limits Awaiting Analysis
7.5CVSS 3.1 base score
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
7References
22 Sep 2026Last modified by NVD

Description

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

LinkTags
https://access.redhat.com/errata/RHSA-2026:69440
https://access.redhat.com/errata/RHSA-2026:69470
https://access.redhat.com/errata/RHSA-2026:70257
https://access.redhat.com/security/cve/CVE-2026-93488
https://bugzilla.redhat.com/show_bug.cgi?id=2536887
https://github.com/netty/netty/releases/tag/netty-4.1.138.Final
https://github.com/netty/netty/releases/tag/netty-4.2.18.Final

Track CVE-2026-93488 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.6CVE-2020-3569Cisco IOS XR DVMRP IGMP packet handling memory exhaustionCisco IOS XR Software mishandles IGMP packets in its Distance Vector Multicast Routing Protocol (DVMRP) feature, allowing crafted traffic to crash th…KEVEPSS 3.3%analysed8.6CVE-2020-3566Cisco IOS XR DVMRP IGMP queue flaw causes memory exhaustionCisco IOS XR Software mishandles queue management for IGMP packets in its DVMRP feature, allowing uncontrolled memory consumption. An unauthenticated…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2026-93488), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.