Advisory Database
  • Advisories
  • Dependency Scanning
  1. maven
  2. ›
  3. io.netty.incubator/netty-incubator-codec-bhttp
  4. ›
  5. CVE-2026-63124

CVE-2026-63124: netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

August 20, 2026

io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can use a tiny malformed request or response to keep the parsing thread busy indefinitely, causing denial of service.

References

  • github.com/advisories/GHSA-8cfx-wx3q-mh5q
  • github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final
  • github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-8cfx-wx3q-mh5q
  • nvd.nist.gov/vuln/detail/CVE-2026-63124

Code Behaviors & Features

Detect and mitigate CVE-2026-63124 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.0.23

Fixed versions

  • 0.0.23

Solution

Upgrade to version 0.0.23 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption
  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

Source file

maven/io.netty.incubator/netty-incubator-codec-bhttp/CVE-2026-63124.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 22 Sep 2026 12:19:34 +0000.