CVE-2026-63124: Netty netty-incubator-codec-bhttp infinite loop in field section parser

CVE-2026-63124 · Severity: high · CVSS 7.5 · Published 2026-08-20

Netty's Binary HTTP parser can enter an infinite loop when processing specially crafted HTTP messages with field sections that end exactly at a known boundary. An attacker sending a tiny malformed request or response can consume 100% of a parsing thread indefinitely, blocking all other work on that thread and causing denial of service.

Technologies: io.netty.incubator:netty-incubator-codec-bhttp (Maven). Vendors: Maven, Netty.

Quick answers

Is CVE-2026-63124 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63124 being exploited in the wild.
How severe is CVE-2026-63124?
High severity, with a CVSS score of 7.5, published 20 August 2026.
Which products and versions are affected?
io.netty.incubator:netty-incubator-codec-bhttp (Maven) <= 0.0.22.Final, ECOSYSTEM:introduced=0,fixed=0.0.23.Final; Netty-Incubator-Codec-Bhttp <= 0.0.22.Final.
Is there a fix for CVE-2026-63124?
Yes. io.netty.incubator:netty-incubator-codec-bhttp (Maven): upgrade to 0.0.23.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63124 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63124?
Check whether you run io.netty.incubator:netty-incubator-codec-bhttp (Maven) or Netty-Incubator-Codec-Bhttp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty.incubator:netty-incubator-codec-bhttp (Maven): upgrade to 0.0.23.Final or later
    # set io.netty.incubator:netty-incubator-codec-bhttp to 0.0.23.Final in your pom.xml or build.gradle

Technical details

The vulnerability is an infinite loop in readFieldSection() of BinaryHttpParser.java caused by an off-by-one boundary check. When a known-length field section ends exactly after a complete field line, readFieldLine() returns null without consuming bytes (due to the condition "if (sumBytes >= in.readableBytes()) return null"). The parser loop then subtracts zero bytes from the remaining field-section length and loops forever. With JVM assertions disabled (the production default), the guard assertion "assert read > 0" is not active. Exploitation requires sending crafted Binary HTTP or OHTTP messages with a specifically constructed field section to a Netty pipeline; no authentication or user interaction is required. An attacker can pin an event-loop thread, degrading or eliminating service availability for all channels on that loop. The fix is available in version 0.0.23.Final, which handles the boundary condition properly and treats incomplete input appropriately.

Affected products

  • Netty netty-incubator-codec-bhttp <= 0.0.22.Final

Identifiers

  • CVE-2026-63124
  • GHSA-8cfx-wx3q-mh5q

Timeline

  • 2026-08-20: disclosed: Published to GitHub Advisory Database
  • 2026-07-12: patched: Fix released in version 0.0.23.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.