Junglewise Threat Intelligence

CVE-2026-61827: Netty Incubator OHTTP unbounded variable-length field buffering

CVE-2026-61827 · Severity: high · CVSS 8.7 · Published 2026-08-20

Executive brief

Netty Incubator's OHTTP codec (BinaryHttpParser) fails to enforce limits on variable-length encoded fields, allowing remote attackers to cause the application to buffer unbounded data and exhaust memory (OOM). This can result in service denial or application crash without authentication or user interaction required.

Technical details

The BinaryHttpParser in netty-incubator-codec-ohttp does not validate or limit the size of variable-length encoded fields controlled by remote peers. An attacker can send HTTP messages with excessively large variable-length field values, causing the parser to allocate unbounded memory buffers, leading to out-of-memory (OOM) conditions and denial of service. The vulnerability is a classic resource exhaustion issue (CWE-400, CWE-770) affecting any networked application using this codec. No authentication or special privileges are required; the attack is triggered over the network during normal HTTP parsing. A patch is available in version 0.0.23.Final, which enforces proper limits on variable-length fields.

Affected products

  • Netty netty-incubator-codec-ohttp (Maven: io.netty.incubator:netty-incubator-codec-bhttp) <= 0.0.22.Final

Timeline

  • 2026-07-18: disclosed: Advisory published by Netty maintainers
  • 2026-07-18: patched: Fix released in version 0.0.23.Final
  • 2026-08-20: advisory: GitHub Advisory Database publication

References

Related threats