CVE-2026-100656
io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining
Affected Products
-
CVE record
No data
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
No data.
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity Low
Privileges Required None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
No EPSS score available.
Key SSVC decision points have not yet been added.
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining | io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining |
| Type | Values Removed | Values Added |
|---|---|---|
| Title | io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining | Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining |
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining | io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining |
| Metrics |
cvssV4_0
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on a single connection while withholding reads on their own end (preventing responses from being flushed) can grow this queue without bound, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final; the issue is fixed in 4.2.18.Final and 4.1.138.Final. | This CVE ID has been rejected as a duplicate. |
| CPEs | ||
| Metrics |
cvssV4_0
|
cvssV4_0
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on a single connection while withholding reads on their own end (preventing responses from being flushed) can grow this queue without bound, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final; the issue is fixed in 4.2.18.Final and 4.1.138.Final. | |
| Title | Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining | |
| First Time appeared |
Netty
Netty netty |
|
| Weaknesses | CWE-770 | |
| CPEs | cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Netty
Netty netty |
|
| References |
| |
| Metrics |
cvssV3_1
|
