Executive brief
Netty's HTTP server codec, a core component used by Java applications to parse and handle incoming HTTP requests, contains a flaw that can cause response bodies to be misrouted between requests. An attacker sending specially crafted pipelined HTTP requests can cause one client to receive another client's response data or have response bodies dropped entirely, leading to data exposure and unsafe connection reuse. This vulnerability affects Java applications using vulnerable versions of the Netty library.
Technical details
The HttpServerCodec improperly handles HTTP/1.1 pipelined requests when a GET request with Expect: 100-continue is followed by a HEAD request. The 100 Continue response incorrectly consumes the request queue entry for the GET, causing the subsequent 200 OK response bodies to be paired with the wrong requests—the GET response body is dropped due to HEAD's no-body rule, while the HEAD response body is sent with the GET's headers. This violates HTTP semantics and enables response splitting and unsafe connection reuse.
Affected products
- Netty Project netty-codec-http 4.2.0.Final through 4.2.16.Final, and 4.1.0 through 4.1.136.Final
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Fixed in 4.2.17.Final and 4.1.137.Final