CVE-2026-63202: Netty Incubator OHTTP BinaryHttpParser infinite loop DoS

CVE-2026-63202 · Severity: high · CVSS 7.5 · Published 2026-08-20

Netty's OHTTP codec contains a denial-of-service vulnerability in its Binary HTTP message parser. An attacker can send unauthenticated encrypted requests that trigger an infinite CPU-bound loop, consuming one worker thread per request at 100% CPU. Exhausting the small fixed thread pool crashes the gateway or client, causing a complete and persistent outage until restart.

Technologies: io.netty.incubator:netty-incubator-codec-bhttp (Maven), Netty Project Netty Incubator Codec OHTTP. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-63202 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63202 being exploited in the wild.
How severe is CVE-2026-63202?
High severity, with a CVSS score of 7.5, published 20 August 2026.
Which products and versions are affected?
io.netty.incubator:netty-incubator-codec-bhttp (Maven) <= 0.0.22.Final, ECOSYSTEM:introduced=0,fixed=0.0.23.Final; Netty Project Netty Incubator Codec OHTTP <= 0.0.22.Final.
Is there a fix for CVE-2026-63202?
Yes. io.netty.incubator:netty-incubator-codec-bhttp (Maven): upgrade to 0.0.23.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63202 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63202?
Check whether you run io.netty.incubator:netty-incubator-codec-bhttp (Maven) or Netty Project Netty Incubator Codec OHTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty.incubator:netty-incubator-codec-bhttp (Maven): upgrade to 0.0.23.Final or later
    # set io.netty.incubator:netty-incubator-codec-bhttp to 0.0.23.Final in your pom.xml or build.gradle

Technical details

The vulnerability is a control-flow bug in BinaryHttpParser.readFieldSection() (lines 619–626). The field-section decoding loop terminates on condition `fieldSectionLength != 0` and relies on two Java assertions to prevent infinite loops. Two cooperating defects enable the hang: (1) if readFieldLine() consumes more bytes than the declared field-section length, the loop counter goes negative and remains != 0 forever; (2) readFieldLine() can legitimately return null without consuming bytes when the buffer is incomplete, causing zero-progress iterations and a tight busy spin. The assert statements (lines 622, 624) that guard against these cases are disabled by default in production JVMs (assertions require -ea flag). The vulnerability is reachable from OHttpServerCodec.decode() and OHttpRequestResponseContext.ContentDecoder.decodeChunk(), which feed decrypted attacker-controlled OHTTP request bodies directly to the parser. A ~17-byte binary message suffices to trigger the hang. Patches are available in version 0.0.23.Final.

Affected products

  • Netty Project netty-incubator-codec-ohttp <= 0.0.22.Final

Identifiers

  • CVE-2026-63202
  • GHSA-4899-mpch-38p3

Timeline

  • 2026-07-18: disclosed
  • 2026-08-20: advisory
  • 2026: patched: version 0.0.23.Final

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.