CVE-2026-100666 netty CVE debrief

Who should care

Defenders responsible for Netty-based applications, particularly those handling HTTP/1.1 requests, should assess their exposure and verify if their versions are within the affected range. They should also review their request handling to prevent potential response splitting attacks.

Why it matters

CVE-2026-100666 is a medium-severity vulnerability in Netty's HttpServerCodec that can lead to response splitting and unsafe connection reuse. Defenders should verify exposure, especially in HTTP/1.1 handling, and prioritize patching to prevent potential attacks.

• Potential for response splitting attacks due to improper pairing of HTTP requests and responses.
• Risk of unsafe connection reuse leading to further exploitation.
• Need for verification of affected versions and application of patches.
• Possible data integrity issues due to misinterpretation of response bodies.

Technical summary

The vulnerability in Netty's HttpServerCodec arises from improper handling of pipelined HTTP/1.1 requests. Specifically, when a client sends a GET request with an Expect: 100-continue header followed by a HEAD request, the codec incorrectly pairs the responses. This results in the GET request's entity being dropped and the HEAD response's body being interpreted as the GET body's response, leading to response splitting.

Defensive priority

Defenders should prioritize verifying exposure in their HTTP/1.1 handling and assess if any compensating controls can mitigate potential impacts.

Recommended defensive actions

• Verify if the used Netty version is within the affected range (4.2.0.Final through 4.2.16.Final or 4.1.136.Final) and update to 4.2.17.Final or 4.1.137.Final if necessary.
• Review HTTP/1.1 request handling to ensure proper pairing of requests and responses.
• Implement additional monitoring to detect potential response splitting attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and fixed versions. However, there is limited information on actual exploitation or victim impact. Defenders should verify affected versions and apply patches. Additional review of request handling and monitoring for potential response splitting attacks is recommended. The vulnerability's impact on data integrity and potential for response splitting attacks should be assessed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.