Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.
CVE-2026-100666
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-100666
netty
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
netty
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "netty",
"product": "netty",
"versions": [
{
"status": "affected",
"version": "4.2.0.Final",
"lessThan": "4.2.17.Final",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "4.2.17.Final",
"versionType": "custom"
}
],
"packageURL": "pkg:maven/io.netty/netty-codec-http",
"defaultStatus": "unaffected"
},
{
"vendor": "netty",
"product": "netty",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "4.1.137.Final",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "4.1.137.Final",
"versionType": "custom"
}
],
"packageURL": "pkg:maven/io.netty/netty-codec-http",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-100666
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #4437 · Revision 1
- Added to Heist Feed
- Publisher date