Resource Exhaustion Vulnerability in Netty Framework
CVE-2026-59899
What is CVE-2026-59899?
The Netty Framework, an asynchronous event-driven network application framework, is vulnerable to a resource exhaustion issue. The vulnerability arises from the HttpContentEncoder, which uses a per-channel acceptEncodingQueue to store incoming HTTP requests. This queue can be populated with attacker-controlled data indefinitely, leading to a significant strain on resources when exploited. Attackers can take advantage of HTTP/1.1 pipelining to send multiple requests at a rate exceeding the application's response capability. This results in a consumption of system resources, potentially rendering the application unresponsive. The issue has been addressed in versions 4.1.136.Final and 4.2.16.Final, providing critical updates that mitigate this risk.
Affected Version(s)
netty >= 4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final
netty < 4.1.136.Final < 4.1.136.Final