Description
This CVE ID has been rejected as a duplicate.
Published: 2026-09-26
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Title io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining

Mon, 28 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Title Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on a single connection while withholding reads on their own end (preventing responses from being flushed) can grow this queue without bound, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final; the issue is fixed in 4.2.18.Final and 4.1.138.Final. This CVE ID has been rejected as a duplicate.
CPEs cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Mon, 28 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on a single connection while withholding reads on their own end (preventing responses from being flushed) can grow this queue without bound, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final; the issue is fixed in 4.2.18.Final and 4.1.138.Final.
Title Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining
First Time appeared Netty
Netty netty
Weaknesses CWE-770
CPEs cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
Vendors & Products Netty
Netty netty
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Netty Netty
cve-icon MITRE

Status: REJECTED

Assigner: VulnCheck

Published:

Updated: 2026-09-28T20:59:52.841Z

Reserved: 2026-09-26T02:33:59.038Z

Link: CVE-2026-100656

cve-icon Vulnrichment

Updated: 2026-09-28T16:44:17.135Z

cve-icon NVD

Status : Rejected

Published: 2026-09-26T14:16:48.390

Modified: 2026-09-28T22:17:30.207

Link: CVE-2026-100656

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-26T13:23:24Z

Links: CVE-2026-100656 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling