PT-2026-63547 · Maven · Io.Netty:Netty-Codec-Http

CVE-2026-59899 · Publicado 2026-07-22 · Atualizado 2026-07-22

OSV

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Impact

HttpContentEncoder (the superclass of the production handler HttpContentCompressor) maintains a per-channel ArrayDeque<CharSequence> named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-59899

GHSA-Q4F6-JM68-57WW

Produtos afetados

Io.Netty:Netty-Codec-Http

Referências · 5

• https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww · Nota
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Nota
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Nota
• https://github.com/netty/netty · Nota
• https://osv.dev/vulnerability/GHSA-q4f6-jm68-57ww · Aviso do Fabricante