REDHAT-BUG-2536891: High severity Netty netty-codec-http vulnerability
Netty is an asynchronous event-driven network application framework widely used for HTTP and other protocols.
A public GitHub Security Advisory (GHSA-pvjx-v7vp-62vq) reports that HttpServerCodec tracks, per connection, which HTTP method each still-unanswered pipelined request used. The first 32 pending entries are bit-packed into a single long, but every entry beyond that spills into methodOverflowQueue, an ArrayDeque with no upper bound.
A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on one connection while withholding reads can grow this queue without limit, causing unbounded heap growth and a memory-exhaustion denial of service. This is the same defect class previously fixed in the sibling class HttpContentEncoder (CVE-2026-59899); HttpServerCodec did not receive the equivalent pipeline-depth bound.
Affected package: io.netty:netty-codec-http Affected versions: <= 4.1.137.Final and >= 4.2.0.Final, <= 4.2.17.Final Fixed versions: 4.1.138.Final and 4.2.18.Final
Advisory: https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.1.138.Final - Upgrade
Upgrade
io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.2.18.Final - Compensating control
Apply network-layer controls to limit the rate and/or size of HTTP/1.1 pipelined requests from a single remote client to mitigate the unbounded pending-method queue growth while upgrading (e.g., enforce per-IP/request throttling at a load balancer/WAF/ingress).
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote, unauthenticated attacker can exploit it against an application using the affected HTTP codec by maintaining a single HTTP/1.1 connection and sending pipelined requests.
What conditions are required for exploitation?
The attacker must pipeline more than 32 HTTP/1.1 requests on one connection and withhold reads, allowing HttpServerCodec's unbounded methodOverflowQueue to grow. No authentication is required.
Which versions should be remediated?
Affected versions are netty-codec-http 4.1.137.Final and earlier, and 4.2.0.Final through 4.2.17.Final. The fixed versions are 4.1.138.Final and 4.2.18.Final.
What is the impact if exploitation succeeds?
The per-connection queue can grow without limit, causing unbounded heap consumption. This can result in a memory-exhaustion denial of service.