---
id: CVE-2026-100656
title: >-
  Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue
  growth flaw in HttpServerCodec
summary: >-
  Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue
  growth flaw in HttpServerCodec. The codec tracks the HTTP method of each
  still-unanswered pipelined request; the first 32 entries are bit-packed into a
  single l…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: netty
product: netty
affected:
  - netty >= 4.2.0.Final < 4.2.18.Final
  - netty < 4.1.138.Final
  - netty < 4.1.138.Final
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T14:16:48.390'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100656'
references:
  - url: 'https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/netty-httpservercodec-unbounded-queue-growth-via-http-1.1-pipelining
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T13:33:20.918Z'
---

## Overview

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on a single connection while withholding reads on their own end (preventing responses from being flushed) can grow this queue without bound, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final; the issue is fixed in 4.2.18.Final and 4.1.138.Final.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.