CVE-2026-59899

CVE-2026-59899 in Netty affects the HttpContentEncoder (superclass of HttpContentCompressor) before 4.1.136.Final and 4.2.16.Final. A per-channel ArrayDeque named acceptEncodingQueue accumulates attacker-controlled data with no size limit, filled on the I/O thread for every inbound HTTP request a...

CVE-2026-59899 Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controll...

Uncontrolled Resource Consumption (Denial Of Service)

io.netty, netty-codec-http is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the HttpContentEncoder maintaining an unbounded acceptEncodingQueue that stores attacker-controlled data without any size limit, which allows an attacker to exploit HTTP/1....

Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Impact HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained...