Executive brief
Netty's OHTTP codec contains a denial-of-service vulnerability in its Binary HTTP message parser. An attacker can send unauthenticated encrypted requests that trigger an infinite CPU-bound loop, consuming one worker thread per request at 100% CPU. Exhausting the small fixed thread pool crashes the gateway or client, causing a complete and persistent outage until restart.
Technical details
The vulnerability is a control-flow bug in BinaryHttpParser.readFieldSection() (lines 619–626). The field-section decoding loop terminates on condition `fieldSectionLength != 0` and relies on two Java assertions to prevent infinite loops. Two cooperating defects enable the hang: (1) if readFieldLine() consumes more bytes than the declared field-section length, the loop counter goes negative and remains != 0 forever; (2) readFieldLine() can legitimately return null without consuming bytes when the buffer is incomplete, causing zero-progress iterations and a tight busy spin. The assert statements (lines 622, 624) that guard against these cases are disabled by default in production JVMs (assertions require -ea flag). The vulnerability is reachable from OHttpServerCodec.decode() and OHttpRequestResponseContext.ContentDecoder.decodeChunk(), which feed decrypted attacker-controlled OHTTP request bodies directly to the parser. A ~17-byte binary message suffices to trigger the hang. Patches are available in version 0.0.23.Final.
Affected products
- Netty Project netty-incubator-codec-ohttp <= 0.0.22.Final
Timeline
- 2026-07-18: disclosed
- 2026-08-20: advisory
- 2026: patched: version 0.0.23.Final