VYPR
← All advisories
High severity7.5NVD Advisory· Published Jul 29, 2026· Updated Aug 6, 2026

CVE-2026-59899

CVE-2026-59899

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder (the superclass of the production handler HttpContentCompressor) maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.netty:netty-codec-httpMaven
>= 4.2.0.Final, < 4.2.16.Final4.2.16.Final
io.netty:netty-codec-httpMaven
< 4.1.136.Final4.1.136.Final

Affected products

241

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.