CVE-2026-100666: Netty 4.2.0 through 4.2.17 Response Desynchronization via HttpServerCodec
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.2.17.Final - Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.1.137.Final
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Netty's io.netty:netty-codec-http HttpServerCodec are affected if they run 4.2.0.Final through 4.2.16.Final, or 4.1.136.Final or earlier. The issue is fixed in 4.2.17.Final and 4.1.137.Final.
What does an attacker need to do to trigger the issue?
An attacker needs network access to send pipelined HTTP/1.1 requests on one connection: a GET request with Expect: 100-continue followed by a HEAD request. No privileges or user interaction are required.
What is the practical effect of successful exploitation?
The connection's response parsing becomes desynchronized: the GET entity is not delivered, and the body of the HEAD response can be interpreted as the GET response body. This can cause response splitting and unsafe reuse of the affected connection.
How should affected systems be remediated?
Upgrade to Netty 4.2.17.Final or later in the 4.2 line, or 4.1.137.Final or later in the 4.1 line.