Is CVE-2026-59899 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59899 being exploited in the wild.

How severe is CVE-2026-59899?

Medium severity, with a CVSS score of 4, published 29 July 2026.

Which products and versions are affected?

io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.

Is there a fix for CVE-2026-59899?

Yes. io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59899 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59899?

Check whether you run io.netty:netty-codec-http (Maven), Netty Project Codec HTTP or Netty Project Netty codec-http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59899: Netty resource exhaustion in HttpContentEncoder via HTTP pipelining

CVE-2026-59899 · Severity: medium · CVSS 4 · Published 2026-07-29

Netty, a popular framework for building network applications, contains a flaw in how it handles certain web requests. An attacker can send a flood of specially crafted messages that cause the application to consume excessive memory, potentially leading to a system crash or service outage. This impacts the availability of any service built using the affected versions of the Netty library.

Technologies: io.netty:netty-codec-http (Maven), Netty Project Codec HTTP. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-59899 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59899 being exploited in the wild.
How severe is CVE-2026-59899?: Medium severity, with a CVSS score of 4, published 29 July 2026.
Which products and versions are affected?: io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.
Is there a fix for CVE-2026-59899?: Yes. io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59899 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59899?: Check whether you run io.netty:netty-codec-http (Maven), Netty Project Codec HTTP or Netty Project Netty codec-http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later

# set io.netty:netty-codec-http to 4.2.16.Final in your pom.xml or build.gradle

Technical details

A resource exhaustion vulnerability exists in Netty's HttpContentEncoder (and its subclass HttpContentCompressor). The component maintains a per-channel ArrayDeque called 'acceptEncodingQueue' that stores attacker-controlled CharSequence data without a size limit. By utilizing HTTP/1.1 pipelining, a remote unauthenticated attacker can flood a connection with requests faster than the application can generate non-1xx responses, causing the queue to grow indefinitely and exhaust heap memory. This issue is resolved in versions 4.1.136.Final and 4.2.16.Final.

Affected products

Netty netty-codec-http < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final

Identifiers

CVE-2026-59899
GHSA-q4f6-jm68-57ww

Timeline

2026-07-07: patched: Version 4.2.16.Final released
2026-07-08: patched: Version 4.1.136.Final released
2026-07-14: advisory: GitHub Security Advisory GHSA-q4f6-jm68-57ww published
2026-07-29: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.