# CVE-2026-63202: Netty Incubator OHTTP BinaryHttpParser infinite loop DoS

Source: https://junglewise.ai/threats/cve-2026-63202-netty-incubator-ohttp-binaryhttpparser-infinite-loop-dos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63202 · Severity: high · CVSS 7.5 · Published 2026-08-20

Netty's OHTTP codec contains a denial-of-service vulnerability in its Binary HTTP message parser. An attacker can send unauthenticated encrypted requests that trigger an infinite CPU-bound loop, consuming one worker thread per request at 100% CPU. Exhausting the small fixed thread pool crashes the gateway or client, causing a complete and persistent outage until restart.

Technologies: [io.netty.incubator:netty-incubator-codec-bhttp (Maven)](https://junglewise.ai/threats/technologies/io-netty-incubator-netty-incubator-codec-bhttp), [Netty Project Netty Incubator Codec OHTTP](https://junglewise.ai/threats/technologies/incubator-codec-ohttp). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-63202 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63202 being exploited in the wild.

**How severe is CVE-2026-63202?** High severity, with a CVSS score of 7.5, published 20 August 2026.

**Which products and versions are affected?** io.netty.incubator:netty-incubator-codec-bhttp (Maven) <= 0.0.22.Final, ECOSYSTEM:introduced=0,fixed=0.0.23.Final; Netty Project Netty Incubator Codec OHTTP <= 0.0.22.Final.

**Is there a fix for CVE-2026-63202?** Yes. io.netty.incubator:netty-incubator-codec-bhttp (Maven): upgrade to 0.0.23.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63202 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63202?** Check whether you run io.netty.incubator:netty-incubator-codec-bhttp (Maven) or Netty Project Netty Incubator Codec OHTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty.incubator:netty-incubator-codec-bhttp (Maven): upgrade to 0.0.23.Final or later

  ```sh
  # set io.netty.incubator:netty-incubator-codec-bhttp to 0.0.23.Final in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is a control-flow bug in BinaryHttpParser.readFieldSection() (lines 619–626). The field-section decoding loop terminates on condition `fieldSectionLength != 0` and relies on two Java assertions to prevent infinite loops. Two cooperating defects enable the hang: (1) if readFieldLine() consumes more bytes than the declared field-section length, the loop counter goes negative and remains != 0 forever; (2) readFieldLine() can legitimately return null without consuming bytes when the buffer is incomplete, causing zero-progress iterations and a tight busy spin. The assert statements (lines 622, 624) that guard against these cases are disabled by default in production JVMs (assertions require -ea flag). The vulnerability is reachable from OHttpServerCodec.decode() and OHttpRequestResponseContext.ContentDecoder.decodeChunk(), which feed decrypted attacker-controlled OHTTP request bodies directly to the parser. A ~17-byte binary message suffices to trigger the hang. Patches are available in version 0.0.23.Final.

## Affected products

- Netty Project netty-incubator-codec-ohttp <= 0.0.22.Final

## Identifiers

- CVE-2026-63202
- GHSA-4899-mpch-38p3

## Timeline

- 2026-07-18: disclosed
- 2026-08-20: advisory
- 2026: patched: version 0.0.23.Final

## References

- [https://api.github.com/users/Pig-Tail](https://api.github.com/users/Pig-Tail)
- [https://github.com/Pig-Tail](https://github.com/Pig-Tail)
- [https://api.github.com/users/Pig-Tail/gists%7B/gist_id%7D](https://api.github.com/users/Pig-Tail/gists%7B/gist_id%7D)
- [https://api.github.com/users/Pig-Tail/repos](https://api.github.com/users/Pig-Tail/repos)
- [https://avatars.githubusercontent.com/u/15832659?v=4](https://avatars.githubusercontent.com/u/15832659?v=4)
- [https://api.github.com/users/Pig-Tail/events%7B/privacy%7D](https://api.github.com/users/Pig-Tail/events%7B/privacy%7D)

## Related threats

- [Netty netty-incubator-codec-ohttp memory leak in AEAD decryption](https://junglewise.ai/threats/cve-2026-54251-netty-netty-incubator-codec-ohttp-memory-leak-in-aead-decryption)
- [Netty Incubator OHTTP unbounded variable-length field buffering](https://junglewise.ai/threats/cve-2026-61827-netty-incubator-ohttp-unbounded-variable-length-field-buffering)
- [Netty netty-incubator-codec-bhttp infinite loop in field section parser](https://junglewise.ai/threats/cve-2026-63124-netty-netty-incubator-codec-bhttp-infinite-loop-in-field-section)
- [Netty Binary HTTP parser integer overflow in varint parsing](https://junglewise.ai/threats/cve-2026-61799-netty-binary-http-parser-integer-overflow-in-varint-parsing)
- [Netty incubator-codec-ohttp predictable cryptographic key on failure](https://junglewise.ai/threats/cve-2026-41207-netty-incubator-codec-ohttp-predictable-cryptographic-key-on)