This CVE ID has been rejected as a duplicate.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Netty
  • Netty

No data.

No data.

References
Link Providers
https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-100656 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-100656 cve-icon
https://www.vulncheck.com/advisories/netty-httpservercodec-unbounded-queue-growth-via-http-1.1-pipelining cve-icon
History

Wed, 30 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Title Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining

Tue, 29 Sep 2026 04:15:00 +0000

Type Values Removed Values Added
Title io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining

Mon, 28 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
Title Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on a single connection while withholding reads on their own end (preventing responses from being flushed) can grow this queue without bound, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final; the issue is fixed in 4.2.18.Final and 4.1.138.Final. This CVE ID has been rejected as a duplicate.
CPEs cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

 cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X'}

Mon, 28 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Sat, 26 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Description Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on a single connection while withholding reads on their own end (preventing responses from being flushed) can grow this queue without bound, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final; the issue is fixed in 4.2.18.Final and 4.1.138.Final.
Title Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining
First Time appeared Netty
Netty netty
Weaknesses CWE-770
CPEs cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
Vendors & Products Netty
Netty netty
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: REJECTED

Assigner: VulnCheck

Published: 2026-09-26T13:23:24.703Z

Updated: 2026-09-28T20:59:52.841Z

Reserved: 2026-09-26T02:33:59.038Z

Link: CVE-2026-100656

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-09-26T14:16:48.390

Modified: 2026-09-28T22:17:30.207

Link: CVE-2026-100656

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-26T13:23:24Z

Links: CVE-2026-100656 - Bugzilla