Executive brief
Netty's Binary HTTP parser can enter an infinite loop when processing specially crafted HTTP messages with field sections that end exactly at a known boundary. An attacker sending a tiny malformed request or response can consume 100% of a parsing thread indefinitely, blocking all other work on that thread and causing denial of service.
Technical details
The vulnerability is an infinite loop in readFieldSection() of BinaryHttpParser.java caused by an off-by-one boundary check. When a known-length field section ends exactly after a complete field line, readFieldLine() returns null without consuming bytes (due to the condition "if (sumBytes >= in.readableBytes()) return null"). The parser loop then subtracts zero bytes from the remaining field-section length and loops forever. With JVM assertions disabled (the production default), the guard assertion "assert read > 0" is not active. Exploitation requires sending crafted Binary HTTP or OHTTP messages with a specifically constructed field section to a Netty pipeline; no authentication or user interaction is required. An attacker can pin an event-loop thread, degrading or eliminating service availability for all channels on that loop. The fix is available in version 0.0.23.Final, which handles the boundary condition properly and treats incomplete input appropriately.
Affected products
- Netty netty-incubator-codec-bhttp <= 0.0.22.Final
Timeline
- 2026-08-20: disclosed: Published to GitHub Advisory Database
- 2026-07-12: patched: Fix released in version 0.0.23.Final