CVE-2026-59899

Analyzed Analyzed - Analysis Complete

Resource Exhaustion in Netty via HTTP Pipelining

Publication date: 2026-07-29

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-06

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-59899

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.1.136 (exc)
netty	netty	From 4.2.0 (inc) to 4.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a resource exhaustion issue in Netty, an asynchronous network framework. The problem occurs in the HttpContentEncoder class, which maintains an unbounded queue for attacker-controlled data. When HTTP/1.1 pipelining is exploited, an attacker can send requests faster than the application can respond, filling the queue and consuming excessive memory.

Detection Guidance

This vulnerability can be detected by checking the Netty version in use. If your system runs Netty versions prior to 4.1.136.Final or 4.2.16.Final, it is vulnerable. Use commands like 'find / -name "netty*.jar" 2>/dev/null' to locate Netty JAR files and 'unzip -p <jarfile> META-INF/MANIFEST.MF | grep Implementation-Version' to check the version.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by exhausting server memory. If exploited, it may cause applications to slow down or crash, disrupting normal operations and potentially making services unavailable to legitimate users.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting server resources, which may disrupt services handling sensitive data. For GDPR, this could impact availability of personal data processing systems. For HIPAA, it might affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or 4.2.16.Final or later. If upgrading is not immediately possible, disable HTTP/1.1 pipelining in your application or network configuration to prevent the resource exhaustion attack vector.

Hi! I’m here to help you understand CVE-2026-59899. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70