CVE-2026-93492 — Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the Hp…
Published: 2026-09-18 · CVSS: 5.3 · CVSS 3.1
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7