CVE-2026-100656
Received Received - Intake

Unbounded Queue Growth in Netty HttpServerCodec

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on a single connection while withholding reads on their own end (preventing responses from being flushed) can grow this queue without bound, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final; the issue is fixed in 4.2.18.Final and 4.1.138.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100656
EUVD
EUVD-2026-87750

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
io.netty netty-codec-http From 4.2.0.Final (inc) to 4.2.17.Final (inc)
io.netty netty-codec-http to 4.1.137.Final (inc)
netty netty From 4.2.0_final (inc) to 4.2.17_final (inc)
netty netty to 4.1.137_final (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100656 is a high-severity vulnerability in Netty's HttpServerCodec component. It allows unbounded queue growth when handling HTTP/1.1 pipelined requests. The codec tracks unanswered requests, storing the first 32 in a bit-packed long, but additional requests overflow into an unbounded ArrayDeque with no size limit. An attacker can exploit this by sending pipelined requests without reading responses, causing the queue to grow indefinitely and leading to memory exhaustion and denial of service.

Detection Guidance

Detecting this vulnerability requires checking Netty versions and monitoring for unusual HTTP/1.1 pipelining activity. Check installed Netty versions with commands like 'find / -name netty-codec-http*.jar' or 'mvn dependency:tree' in Java projects. Monitor heap usage and network traffic for sustained high memory consumption or pipelined requests without responses. Tools like Wireshark can capture HTTP pipelining attempts.

Impact Analysis

This vulnerability can impact you by causing denial of service on affected Netty servers. An unauthenticated remote attacker could exploit it to consume excessive memory on your server, leading to crashes or degraded performance. Systems using vulnerable Netty versions (4.2.0.Final to 4.2.17.Final or 4.1.137.Final and earlier) are at risk if they handle HTTP/1.1 pipelined requests.

Mitigation Strategies

Upgrade Netty to versions 4.2.18.Final or 4.1.138.Final or later immediately. If upgrading is not possible, disable HTTP/1.1 pipelining in your server configuration or implement network-level protections to block pipelined requests. Monitor system memory and network traffic for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100656. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart