CVE-2026-100666
Received Received - Intake

HTTP/1.1 Response Splitting in Netty HttpServerCodec

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100666
EUVD
EUVD-2026-87760

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
netty netty_codec_http From 4.2.0_Final (inc) to 4.2.16_Final (inc)
netty netty_codec_http to 4.1.136_Final (inc)
netty netty_codec_http 4.2.17_Final
netty netty_codec_http 4.1.137_Final
netty netty From 4.2.0 (inc) to 4.2.16 (inc)
netty netty to 4.1.136 (inc)
netty netty 4.2.17
netty netty 4.1.137

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Netty's HttpServerCodec affects versions 4.2.0 through 4.2.16 and 4.1.0 through 4.1.136. It causes response desynchronization when HTTP pipelining is used with HEAD requests and Expect: 100-continue headers. The codec incorrectly pairs responses with requests, leading to dropped or misdelivered response bodies. This can cause response splitting, where a client receives a response body intended for a different request.

Detection Guidance

Detecting this vulnerability requires checking the Netty version in use. Inspect your application's dependencies or server logs for Netty versions between 4.2.0.Final to 4.2.16.Final or 4.1.0 to 4.1.136.Final. Commands like 'mvn dependency:tree' for Maven or 'gradle dependencies' for Gradle can help identify the version. Additionally, monitor HTTP traffic for desynchronization patterns, such as mismatched response/request pairs or dropped entities.

Impact Analysis

This vulnerability can lead to response splitting, where response bodies are delivered to the wrong client or request. This may result in data leaks, unauthorized access to sensitive information, or disruption of services. Attackers could exploit this to manipulate responses, bypass security controls, or cause denial-of-service conditions.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized access to sensitive data through response splitting. Organizations may face legal penalties, reputational damage, and loss of trust if exploited.

Mitigation Strategies

Upgrade Netty to version 4.2.17.Final or later for the 4.2.x branch, or to 4.1.137.Final or later for the 4.1.x branch. If upgrading is not immediately possible, disable HTTP pipelining on affected servers or implement strict request/response validation to detect desynchronization. Remove or restrict use of HEAD requests with Expect: 100-continue headers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100666. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart