CVE-2026-100666: Netty HttpServerCodec response desynchronization

CVE-2026-100666 · Severity: high · CVSS 7.3 · Published 2026-09-26

Netty's HTTP server codec, a core component used by Java applications to parse and handle incoming HTTP requests, contains a flaw that can cause response bodies to be misrouted between requests. An attacker sending specially crafted pipelined HTTP requests can cause one client to receive another client's response data or have response bodies dropped entirely, leading to data exposure and unsafe connection reuse. This vulnerability affects Java applications using vulnerable versions of the Netty library.

Technologies: Netty Project Netty codec-http. Vendors: Netty Project.

Quick answers

Is CVE-2026-100666 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-100666 being exploited in the wild.
How severe is CVE-2026-100666?
High severity, with a CVSS score of 7.3, published 26 September 2026.
Which products and versions are affected?
Netty Project Netty codec-http 4.2.0.Final through 4.2.16.Final, and 4.1.0 through 4.1.136.Final.
Is there a fix for CVE-2026-100666?
A patch was published on 2026-09-26: Fixed in 4.2.17.Final and 4.1.137.Final Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100666 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-100666?
Check whether you run Netty Project Netty codec-http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The HttpServerCodec improperly handles HTTP/1.1 pipelined requests when a GET request with Expect: 100-continue is followed by a HEAD request. The 100 Continue response incorrectly consumes the request queue entry for the GET, causing the subsequent 200 OK response bodies to be paired with the wrong requests—the GET response body is dropped due to HEAD's no-body rule, while the HEAD response body is sent with the GET's headers. This violates HTTP semantics and enables response splitting and unsafe connection reuse.

Affected products

  • Netty Project netty-codec-http 4.2.0.Final through 4.2.16.Final, and 4.1.0 through 4.1.136.Final

Timeline

  • 2026-09-26: disclosed
  • 2026-09-26: patched: Fixed in 4.2.17.Final and 4.1.137.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.