CVE-2026-93563

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A flaw exists in the SmtpResponseDecoder component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, can send a specially crafted, unbounded multi-line SMTP response that lacks a terminator. This causes unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, resulting in an OutOfMemoryError and a denial of service (DoS) due to a process crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.