PT-2026-63547 · Maven · Io.Netty:Netty-Codec-Http

CVE-2026-59899 · Published 2026-07-22 · Updated 2026-07-22

OSV

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Impact

HttpContentEncoder (the superclass of the production handler HttpContentCompressor) maintains a per-channel ArrayDeque<CharSequence> named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-59899

GHSA-Q4F6-JM68-57WW

Affected Products

Io.Netty:Netty-Codec-Http

References · 5

• https://osv.dev/vulnerability/GHSA-q4f6-jm68-57ww · Vendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Note
• https://github.com/netty/netty · Note