Executive brief
Netty, a popular framework for building network applications, contains a flaw in how it handles certain web requests. An attacker can send a flood of specially crafted messages that cause the application to consume excessive memory, potentially leading to a system crash or service outage. This impacts the availability of any service built using the affected versions of the Netty library.
Technical details
A resource exhaustion vulnerability exists in Netty's HttpContentEncoder (and its subclass HttpContentCompressor). The component maintains a per-channel ArrayDeque called 'acceptEncodingQueue' that stores attacker-controlled CharSequence data without a size limit. By utilizing HTTP/1.1 pipelining, a remote unauthenticated attacker can flood a connection with requests faster than the application can generate non-1xx responses, causing the queue to grow indefinitely and exhaust heap memory. This issue is resolved in versions 4.1.136.Final and 4.2.16.Final.
Affected products
- Netty netty-codec-http < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final
Timeline
- 2026-07-07: patched: Version 4.2.16.Final released
- 2026-07-08: patched: Version 4.1.136.Final released
- 2026-07-14: advisory: GitHub Security Advisory GHSA-q4f6-jm68-57ww published
- 2026-07-29: disclosed: NVD publication date