CVE-2026-61827: Netty Incubator OHTTP unbounded variable-length field buffering

CVE-2026-61827 · Severity: high · CVSS 4 · Published 2026-08-20

Netty Incubator's OHTTP codec (BinaryHttpParser) fails to enforce limits on variable-length encoded fields, allowing remote attackers to cause the application to buffer unbounded data and exhaust memory (OOM). This can result in service denial or application crash without authentication or user interaction required.

Technologies: io.netty.incubator:netty-incubator-codec-bhttp (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-61827 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61827 being exploited in the wild.
How severe is CVE-2026-61827?
High severity, with a CVSS score of 4, published 20 August 2026.
Which products and versions are affected?
io.netty.incubator:netty-incubator-codec-bhttp (Maven) <= 0.0.22.Final, ECOSYSTEM:introduced=0,fixed=0.0.23.Final.
Is there a fix for CVE-2026-61827?
Yes. io.netty.incubator:netty-incubator-codec-bhttp (Maven): upgrade to 0.0.23.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61827 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61827?
Check whether you run io.netty.incubator:netty-incubator-codec-bhttp (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty.incubator:netty-incubator-codec-bhttp (Maven): upgrade to 0.0.23.Final or later
    # set io.netty.incubator:netty-incubator-codec-bhttp to 0.0.23.Final in your pom.xml or build.gradle

Technical details

The BinaryHttpParser in netty-incubator-codec-ohttp does not validate or limit the size of variable-length encoded fields controlled by remote peers. An attacker can send HTTP messages with excessively large variable-length field values, causing the parser to allocate unbounded memory buffers, leading to out-of-memory (OOM) conditions and denial of service. The vulnerability is a classic resource exhaustion issue (CWE-400, CWE-770) affecting any networked application using this codec. No authentication or special privileges are required; the attack is triggered over the network during normal HTTP parsing. A patch is available in version 0.0.23.Final, which enforces proper limits on variable-length fields.

Affected products

  • Netty netty-incubator-codec-ohttp (Maven: io.netty.incubator:netty-incubator-codec-bhttp) <= 0.0.22.Final

Identifiers

  • CVE-2026-61827
  • GHSA-hmq9-67w8-j5pw

Timeline

  • 2026-07-18: disclosed: Advisory published by Netty maintainers
  • 2026-07-18: patched: Fix released in version 0.0.23.Final
  • 2026-08-20: advisory: GitHub Advisory Database publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.