← Back to the live CVE advisory feed

CVE-2026-100656: Product identification pending

Severity

8.7 (HIGH)

Affected versions

Through 4.2.17.Final

Fixed version

4.2.18.Final

Patch status

Patched

Published

2026-09-26T14:16:48.390

Modified

2026-09-26T14:16:48.390

Why it matters

This matters because the affected product may be exploitable without valid credentials. Internet-facing deployments should be reviewed first.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.

Technical summary

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on a single connection while withholding reads on their own end (preventing responses from being flushed) can grow this queue without bound, causing unbounded heap growth and denial of service. Affected versions are 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final; the issue is fixed in 4.2.18.Final and 4.1.138.Final.

View the official NVD record for CVE-2026-100656

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.