# CVE-2026-100656: Netty HttpServerCodec unbounded queue growth via HTTP/1.1 pipelining

Source: https://junglewise.ai/threats/cve-2026-100656-netty-io-netty-netty-codec-http-contains-an-unbounded-per  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100656 · Severity: high · CVSS 7.5 · Published 2026-09-26

Netty is a widely-used Java networking library that powers HTTP/1.1 servers. An unauthenticated attacker can exploit the HttpServerCodec component by sending pipelined HTTP requests while deliberately blocking responses, causing the server to accumulate an unbounded in-memory queue that exhausts heap memory and crashes the service.

Technologies: [Netty-Codec-Http](https://junglewise.ai/threats/technologies/netty-netty-codec-http). Vendors: [Netty](https://junglewise.ai/threats/vendors/netty).

## Quick answers

**Is CVE-2026-100656 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100656 being exploited in the wild.

**How severe is CVE-2026-100656?** High severity, with a CVSS score of 7.5, published 26 September 2026.

**Which products and versions are affected?** Netty-Codec-Http 4.2.0.Final through 4.2.17.Final, 4.1.0.Final through 4.1.137.Final.

**Is there a fix for CVE-2026-100656?** A patch was published on 2026-09-26: 4.2.18.Final and 4.1.138.Final released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100656 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100656?** Check whether you run Netty-Codec-Http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The HttpServerCodec class tracks pending HTTP request methods using a bit-packed long (32 entries) plus an unbounded ArrayDeque (methodOverflowQueue) for overflow. The enqueueMethod() function adds entries unconditionally without size limits. An attacker sending pipelined requests on one connection while withholding read operations (preventing response flush) forces the decoder to run ahead, filling the overflow queue without bound. Remote, unauthenticated, network-only attack; patches are available in 4.2.18.Final and 4.1.138.Final.

## Affected products

- Netty netty-codec-http 4.2.0.Final through 4.2.17.Final, 4.1.0.Final through 4.1.137.Final

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: 4.2.18.Final and 4.1.138.Final released

## References

- [https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq](https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq)
- [https://www.vulncheck.com/advisories/netty-httpservercodec-unbounded-queue-growth-via-http-1.1-pipelining](https://www.vulncheck.com/advisories/netty-httpservercodec-unbounded-queue-growth-via-http-1.1-pipelining)

## Related threats

- [Netty unbounded queue denial of service in WebSocketServerExtensionHandler](https://junglewise.ai/threats/cve-2026-100658-netty-io-netty-netty-codec-http-contains-an-unbounded-per)
- [Netty netty-codec-http denial of service in SpdySessionHandler](https://junglewise.ai/threats/cve-2026-100655-netty-io-netty-netty-codec-http-versions-up-to-and-including-4-1)