CVE-2026-61827: Maven/io.netty.incubator:netty-incubator-codec-bhttp vulnerability
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty.incubator:netty-incubator-codec-bhttpto a version that resolves this vulnerability.Fixed in 0.0.23.Final
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to act as a remote peer and control encoded variable-length field values processed by the affected codec. The supplied lengths can cause the application to continue buffering data until it runs out of memory.
How can I determine whether my deployment is exposed?
Review whether your application uses the Maven artifact io.netty.incubator:netty-incubator-codec-bhttp and processes data from remote peers. Deployments that do not accept or process peer-controlled encoded field data are not exposed through this attack path.