CVE-2026-59899: Netty http-codec-http Unbounded Queue Growth Leading to Denial of Service
Summary
CVE-2026-59899: Impact HttpContentEncoder (the superclass of the production handler HttpContentCompressor) maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. Affects io.netty:netty-codec-http across 2 version ranges.
< 4.1.136.Final
>= 4.2.0.Final, < 4.2.16.Final
Fixed in 4.1.136.Final or 4.2.16.Final, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular asynchronous event-driven network application framework that enables quick and efficient development of network applications such as protocol servers and clients. The 'netty-codec-http' package is a crucial component that provides HTTP protocol support, including encoding and decoding of HTTP messages. However, it has a vulnerability that allows for unbounded growth of a per-connection queue, which can be exploited to cause denial of service.
Vulnerability Detail
The vulnerability arises from the 'HttpContentEncoder' class, which maintains a per-channel 'ArrayDeque<CharSequence>' named 'acceptEncodingQueue'. This queue accumulates data controlled by an attacker without any size limit. When an attacker exploits HTTP/1.1 pipelining, they can flood the connection with requests faster than the application can respond, leading to resource exhaustion and potential denial of service.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.1.136.Final4.1.136.Final -
>= 4.2.0.Final, < 4.2.16.Final4.2.16.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit the number of concurrent requests your application can handle or implement rate limiting to mitigate the impact of this vulnerability until you can apply the patch.
Conclusion
CVE-2026-59899 is a significant vulnerability in the Netty 'netty-codec-http' package that can lead to denial of service through unbounded queue growth. It is crucial to update to the patched versions to mitigate this risk and ensure the stability of your applications.
See every vulnerability recorded for io.netty:netty-codec-http →
FAQ
CVE-2026-59899 is a vulnerability in the Netty 'netty-codec-http' package that allows for unbounded queue growth, leading to potential denial of service.
If your application uses the affected version of the 'netty-codec-http' package, it could be susceptible to denial of service attacks due to resource exhaustion.
Versions of 'netty-codec-http' from 4.2.0.Final to 4.2.15.Final and from 0 to 4.1.135.Final are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. You can also check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-codec-http.
