HIGHCVSS 8.7

CVE-2026-61827

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

Published: 2026-08-20
Modified: 2026-08-20
Aliases: GHSA-hmq9-67w8-j5pw
Sources: github-advisory

Summary

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	io.netty.incubator:netty-incubator-codec-bhttp	—	0.0.23.Final

Remediation: Upgrade to 0.0.23.Final or later.

References

https://github.com/advisories/GHSA-hmq9-67w8-j5pw

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.