CVE-2026-61827
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score usedGHSA-hmq9-67w8-j5pw
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.
- Record
GHSA-hmq9-67w8-j5pw- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
OSVGHSA-hmq9-67w8-j5pw
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.
- Record
GHSA-hmq9-67w8-j5pw- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400, CWE-770
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.netty.incubator:netty-incubator-codec-bhttpMaven |
through 0.0.22.Final | 0.0.23.Final |
io.netty.incubator:netty-incubator-codec-bhttpMaven |
before 0.0.23.Final, plus listed versions 0.0.1.Final0.0.10.Final0.0.11.Final0.0.12.Final0.0.13.Final Show 17 moreShow less0.0.14.Final0.0.15.Final0.0.16.Final0.0.17.Final0.0.18.Final0.0.19.Final0.0.2.Final0.0.20.Final0.0.21.Final0.0.22.Final0.0.3.Final0.0.4.Final0.0.5.Final0.0.6.Final0.0.7.Final0.0.8.Final0.0.9.Final |
0.0.23.Final |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-61827 is a high vulnerability (CVSS 8.7) in io.netty.incubator:netty-incubator-codec-bhttp, published August 20, 2026. No source lists public exploit code. Fixed in io.netty.incubator:netty-incubator-codec-bhttp 0.0.23.Final.