VulnSocial

CVE-2026-93558Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1035

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-20: 1Technical Details · 2026-09-20: 109-20
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • DFIR Lab@DFIR_Lab
    Disclosure

    🚨 HIGH SEVERITY: CVE-2026-93558 (CVSS 7.5) WebSocketServerExtensionHandler vulnerable to DoS via unbounded queue growth. Network-exploitable, no authentication required. Impact: High availability risk #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/OP6rGWGjMA

    Post summary

    The tweet announces CVE-2026-93558, a DoS vulnerability in WebSocketServerExtensionHandler with CVSS 7.5, detailing it as network-exploitable without authentication, but provides no PoC, exploit tool, active exploitation evidence, or specific patch/remediation details beyond a non-qualifying #PatchNow hashtag.

    0000040
    139 followersView on X

Explore more

Back to dashboard