Vulnerability · Published Jul 29, 2026 · Assigned by GitHub_M

CVE-2026-59899Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Medium 6.9

In plain English

A medium-severity resource allocation without limits in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.6%top 50.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	netty	no fix listed	DEBIAN-CVE-2026-59899
Debian:13	netty	no fix listed	DEBIAN-CVE-2026-59899
Debian:14	netty	no fix listed	DEBIAN-CVE-2026-59899
Maven	io.netty:netty-codec-http	4.2.16.Final	GHSA-q4f6-jm68-57ww
Maven	io.netty:netty-codec-http	4.1.136.Final	GHSA-q4f6-jm68-57ww
Ubuntu:26.10	netty	no fix listed	UBUNTU-CVE-2026-59899

Affected products (as reported)

Vendor	Product	Versions
netty	netty	>= 4.2.0.Final, < 4.2.16.Final< 4.1.136.Final

Weakness: CWE-770 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww x_refsource_CONFIRM
https://github.com/netty/netty/releases/tag/netty-4.1.136.Final x_refsource_MISC
https://github.com/netty/netty/releases/tag/netty-4.2.16.Final x_refsource_MISC