CVE-2026-59899 in Netty
Summary
by MITRE • 07/29/2026
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in Netty's HttpContentEncoder affects asynchronous network applications that process HTTP requests through the framework's event-driven architecture. This flaw exists in versions prior to 4.1.136.Final and 4.2.16.Final where the HttpContentEncoder class maintains an unbounded ArrayDeque collection named acceptEncodingQueue for each network channel. The queue accumulates attacker-controlled HTTP Accept-Encoding header values without any size restrictions, creating a predictable resource exhaustion vector that can be exploited through carefully crafted HTTP/1.1 pipelining attacks.
The technical implementation of this vulnerability stems from the design pattern where inbound HTTP requests are processed on the I/O thread and immediately add data to the acceptEncodingQueue collection. Each request contributes to the queue's growth regardless of whether the application has begun processing responses, creating a fundamental mismatch between request ingestion and response production rates. This architectural flaw allows attackers to flood connections with multiple pipelined requests that fill the queue indefinitely while the application processes responses at a much slower pace.
The operational impact of this vulnerability manifests as a resource exhaustion condition that can lead to complete denial of service for affected Netty applications. Attackers exploit HTTP/1.1 pipelining capabilities to send numerous requests faster than the application can drain the acceptEncodingQueue, eventually consuming all available heap memory on the server. This creates a persistent denial of service scenario where legitimate users cannot establish new connections or process requests due to memory exhaustion. The vulnerability affects any application using Netty's HTTP compression features and is particularly dangerous in high-throughput environments where connection reuse and pipelining are common.
This vulnerability maps directly to CWE-400: Uncontrolled Resource Consumption and aligns with ATT&CK technique T1499.004: Endpoint Denial of Service, specifically targeting resource exhaustion through memory consumption. The flaw represents a classic example of inadequate input validation and resource management in asynchronous network frameworks where attacker-controlled data is accumulated without proper bounds checking or rate limiting mechanisms.
Mitigation strategies include upgrading to Netty versions 4.1.136.Final or 4.2.16.Final where the issue has been resolved through bounded queue implementations and proper resource management. Organizations should also implement connection-level rate limiting, request queuing mechanisms, and memory monitoring to detect unusual resource consumption patterns. Additionally, network administrators can deploy IDS/IPS signatures that monitor for HTTP pipelining abuse patterns and consider implementing circuit breaker patterns to prevent cascading failures when resource exhaustion occurs.
The fix implemented in affected versions addresses the core issue by introducing proper size limits to the acceptEncodingQueue collection and ensuring that queue growth is bounded based on connection-specific constraints. This prevents attackers from indefinitely accumulating data in memory while maintaining the functionality of HTTP content encoding compression. The solution also includes proper cleanup mechanisms that ensure queues are drained appropriately during normal application operation, preventing accumulation under both normal and attack conditions.
Security teams should monitor for potential exploitation attempts using HTTP pipelining patterns and implement comprehensive logging to detect unusual queue growth rates. The vulnerability demonstrates the importance of resource management in asynchronous frameworks where I/O processing threads may not align with application response generation timing. Organizations using Netty-based applications must ensure proper patch management and regularly audit their network application architectures for similar resource accumulation patterns that could lead to denial of service conditions.
This vulnerability highlights a critical gap in security testing for asynchronous network frameworks where the timing mismatch between request handling and response production creates exploitable resource accumulation scenarios. The flaw serves as an important reminder that even well-established libraries can contain subtle issues related to resource management under concurrent processing conditions, particularly when attacker-controlled data flows through I/O threads without proper bounds checking.