CVE-2026-28980

The "HTTPDecoder" in "NIOHTTP1" enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary number of small, valid headers in a single request and have them all accumulated into the resulting...