CVE-2026-93563

A flaw was found in Netty's SmtpResponseDecoder component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an OutOfMemoryError and a denial of service (DoS) due to a process crash.