CVE-2026-100666: Inconsistent Interpretation of HTTP Requests

Netty’s HttpServerCodec pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection, resulting in response splitting and unsafe connection reuse. The netty-all artifact is a shaded jar that embeds the vulnerable HttpServerCodec class up to and including version 4.1.68; from version 4.1.69 onwards it ships no bytecode and is not affected.