netty-incubator-codec-bhttp CVE-2026-61827
HIGH
GHSA-hmq9-67w8-j5pw
Severity by source
Network-reachable parser, no auth or complexity required, sole impact is availability via OOM; no confidentiality or integrity effect.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
3DescriptionCVE.org
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.
AnalysisAI
Unbounded memory consumption in Netty's Binary HTTP (BHTTP) codec allows any remote peer to trigger out-of-memory (OOM) conditions by sending crafted encoded variable-length field values. The BinaryHttpParser in netty-incubator-codec-bhttp versions up to and including 0.0.22.Final applies no upper-bound enforcement on variable-length integers used for field sizes, meaning a malicious or misbehaving peer can instruct the parser to buffer arbitrarily large amounts of data until the JVM heap is exhausted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must be using the io.netty.incubator:netty-incubator-codec-bhttp library at version 0.0.22.Final or earlier and must expose a network-reachable endpoint that accepts and parses Binary HTTP (BHTTP) messages via BinaryHttpParser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS score or vector is provided in the available data, so severity metrics must be independently assessed (see assessed_cvss_vector). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to netty-incubator-codec-bhttp 0.0.23.Final (part of the netty-incubator-codec-parent-ohttp-0.0.23.Final release), available from the project's GitHub releases page at https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final and from Maven Central under the io.netty.incubator group. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all applications using netty-incubator-codec-bhttp version 0.0.22.Final or earlier through dependency scanning and code analysis to establish scope and criticality of exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today