Executive brief
Netty's Binary HTTP decoder library contains an integer overflow vulnerability in its varint length parser. When processing HTTP message headers encoded in the binary HTTP format, the parser uses 32-bit integers to track cumulative byte offsets while adding attacker-supplied 64-bit length values, causing wraparound and negative indices. A remote attacker can crash individual connections by sending a tiny (15-byte) malformed message, leading to denial of service for any application accepting binary HTTP traffic from untrusted sources.
Technical details
The vulnerability exists in io.netty.incubator:netty-incubator-codec-bhttp's BinaryHttpParser class, specifically in methods readRequestHead(), readFieldLine(), and getIndeterminateLength(). These methods declare cumulative offset counters as 32-bit signed integers (int sumBytes) and then perform compound assignment operations with 64-bit protocol lengths (long values), which Java narrows back to int. A length value of 2^31 (0x80000000) causes sumBytes to wrap negative, bypassing the bounds check (sumBytes >= in.readableBytes()), and subsequently triggering an unchecked ArrayIndexOutOfBoundsException or IndexOutOfBoundsException when computing buffer indices. The vulnerability requires network-reachable access to an application exposing BinaryHttpDecoder, with no authentication required. An attacker can trigger repeated exceptions to sustain denial of service. The fix, available in version 0.0.23.Final, uses 64-bit arithmetic throughout and validates lengths before narrowing to 32-bit indices.
Affected products
- Netty netty-incubator-codec-bhttp <= 0.0.22.Final
Timeline
- 2026-08-20: disclosed: Advisory published to GitHub Advisory Database
- 2026-08-20: patched: Fix released in version 0.0.23.Final