Response Desynchronization Vulnerability in Netty's HttpServerCodec

CVE-2026-100666

What is CVE-2026-100666?

Netty's HttpServerCodec contains a vulnerability that leads to response desynchronization upon handling HTTP/1.1 requests. When a client sends a GET request with an Expect: 100-continue header followed by a HEAD request, the response for the GET may be incorrectly paired with the HEAD response. Consequently, the GET request body is not delivered, while the HEAD response body can be misinterpreted as part of the GET response. This flaw risks connection reuse and can lead to response splitting issues.

References