CVE-2026-93563: Red Hat Build Of Apache Camel For Spring Boot 4

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash.

Affected products

• Red Hat Red Hat Build Of Apache Camel For Spring Boot 4
• Red Hat Red Hat Fuse 7
• Red Hat Red Hat JBoss Enterprise Application Platform 7
• Red Hat Red Hat Single Sign-On 7

Published 2026-09-18. Last modified 2026-09-25.