GHSA-hmq9-67w8-j5pw: Maven/io.netty.incubator:netty-incubator-codec-bhttp vulnerability
Published Aug 20, 2026
·Updated
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.
Affected Software
1 affected componentFixes available
maven/io.netty.incubator:netty-incubator-codec-bhttp<=0.0.22.Final
0.0.23.Final
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty.incubator:netty-incubator-codec-bhttpto a version that resolves this vulnerability.Fixed in 0.0.23.Final
Event History
Aug 20, 2026
Advisory Published
via GitHub·06:43 PM
Data Sourced
via GitHub·06:43 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
A remote peer that can send encoded fields to the affected component can control the encoded variable lengths used for those fields.
2
What is the expected impact of exploitation?
An attacker can cause the component to continue buffering data, eventually exhausting available memory and triggering an out-of-memory condition.