CVE-2026-63124: netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can use a tiny malformed request or response to keep the parsing thread busy indefinitely, causing denial of service.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-63124 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →