CVE-2026-100656 netty CVE debrief

Who should care

Defenders responsible for Netty-based systems, especially those handling HTTP/1.1 requests, should assess exposure and prioritize patching or mitigation. This includes operators, security teams, and vulnerability management teams. They should verify affected versions and exposure in their inventory and implement mitigations if patching is not feasible.

Why it matters

CVE-2026-100656 is a high-severity vulnerability in Netty's HttpServerCodec, allowing for unbounded heap growth and denial of service via pipelined HTTP/1.1 requests. Defenders should prioritize patching or mitigating this vulnerability, especially in systems handling HTTP/1.1 requests.

• Denial of service via unbounded heap growth.
• Potential for performance degradation due to increased memory usage.
• Need for verification of affected versions and exposure in inventory.
• Priority for patching or mitigating in systems handling HTTP/1.1 requests.

Technical summary

The HttpServerCodec in Netty has an unbounded per-connection queue growth flaw. An attacker can pipeline HTTP/1.1 requests on a single connection, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to 4.1.137.Final. The issue is fixed in 4.2.18.Final and 4.1.138.Final. The vulnerability can cause performance degradation due to increased memory usage. Defenders should prioritize patching or mitigating this vulnerability, especially in systems handling HTTP/1.1 requests.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems handling HTTP/1.1 requests.

Recommended defensive actions

• Assess exposure and prioritize patching for Netty versions 4.2.0.Final through 4.2.17.Final and 4.1.0.Final through 4.1.137.Final.
• Implement mitigations, such as limiting pipelined requests or monitoring for suspicious activity, if patching is not feasible.
• Verify that systems handling HTTP/1.1 requests are updated to 4.2.18.Final or 4.1.138.Final.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability was disclosed on 2026-09-26T14:16:48.390Z. The NVD entry and CVE record are official sources for vulnerability information. Defenders should verify affected versions and exposure in their inventory. The CVE Program and NVD provide additional context for understanding the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.