GHSA-q4f6-jm68-57ww
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-59899
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Description
### Impact `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses.
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · io.netty:netty-codec-http | introduced 4.2.0.Final, fixed 4.2.16.Final |
| Maven · io.netty:netty-codec-http | introduced 0, fixed 4.1.136.Final |
Références
- https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww WEB
- https://github.com/netty/netty PACKAGE
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final WEB
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |