Kurz gesagt
- CVE-2026-59899 ist eine Schwachstelle (HOCH (CVSS 7.5)) in io.netty:netty-codec-http, netty (netty).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.61%, höher als bei 49.2% aller Schwachstellen.
- Abhilfe: auf 4.2.16.Final, 4.1.136.Final, 4.2.16, 4.1.136 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| io.netty:netty-codec-http Maven | ≥ 4.2.0.Final, < 4.2.16.Final< 4.1.136.Final
| 4.2.16.Final4.1.136.Final
|
| netty | ≥ 4.2.0, < 4.2.16< 4.1.136
| 4.2.164.1.136
|
Description
Impact
HttpContentEncoder (the superclass of the production handler HttpContentCompressor) maintains a per-channel ArrayDeque<CharSequence> named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses.
NVD description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free