CVE-2026-100666

Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

CVSS 4.0 6.9 MEDIUMCVSS 3.1 7.3 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-100666

Published

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-100666

Published

netty

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "netty",
                    "product": "netty",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:maven/io.netty/netty-codec-http",
                    "versions": [
                        {
                            "version": "4.2.0.Final",
                            "status": "affected",
                            "versionType": "custom",
                            "lessThan": "4.2.17.Final"
                        },
                        {
                            "version": "4.2.17.Final",
                            "status": "unaffected",
                            "versionType": "custom"
                        }
                    ]
                }

netty

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "netty",
                    "product": "netty",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:maven/io.netty/netty-codec-http",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "custom",
                            "lessThan": "4.1.137.Final"
                        },
                        {
                            "version": "4.1.137.Final",
                            "status": "unaffected",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON