High

Netty has HttpClientCodec response desynchronization

Disclosed: 07.05.2026
Updated: 11.10.2026 13:20

Summary

If HttpClientCodec is configured, there are use cases when a response body from one request, can be parsed as another's.

Details

HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset.

Prerequisites

HTTP/1.1 pipelining
HEAD in the pipeline
The server sends 1xx

PoC

java

    @Test
    public void test() {
        EmbeddedChannel channel = new EmbeddedChannel(new HttpClientCodec());

        assertTrue(channel.writeOutbound(new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.GET, "/1")));
        ByteBuf request = channel.readOutbound();
        request.release();
        assertNull(channel.readOutbound());

        assertTrue(channel.writeOutbound(new DefaultFullHttpRequest(HttpVersion.HTTP_1_1, HttpMethod.HEAD, "/2")));
        request = channel.readOutbound();
        request.release();
        assertNull(channel.readOutbound());

        String responseStr = "HTTP/1.1 103 Early Hints\r\n\r\n" +
                "HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello" +
                "HTTP/1.1 200 OK\r\n\r\n";
        assertTrue(channel.writeInbound(Unpooled.copiedBuffer(responseStr, CharsetUtil.US_ASCII)));

        // Response 1
        HttpResponse response = channel.readInbound();
        assertEquals(HttpResponseStatus.EARLY_HINTS, response.status());
        LastHttpContent last = channel.readInbound();
        assertEquals(0, last.content().readableBytes());
        last.release();

        // Response 2
        response = channel.readInbound();
        assertEquals(HttpResponseStatus.OK, response.status());
        last = channel.readInbound();
        assertEquals(0, last.content().readableBytes());
        last.release();

        // Response 3
        FullHttpResponse response1 = channel.readInbound();
        assertTrue(response1.decoderResult().isFailure());
        assertEquals(0, response1.content().readableBytes());
        response1.release();

        assertFalse(channel.finish());
    }

Impact

Integrity/availability of HTTP parsing on that connection, unsafe reuse of the socket.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	io.netty:netty-codec-http	>= 4.2.0.Alpha1, < 4.2.13.Final, < 4.1.133.Final	4.2.13.Final, 4.1.133.Final

References

CVSS score 7.3/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE): CWE-444
Platform: Java / Kotlin (Maven)
Package: io.netty:netty-codec-http
Disclosed: 07.05.2026
Updated: 11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-57rv-r2g8-2cj3 - CC BY 4.0

Vulnerability history: io.netty:netty-codec-http

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (24) in the archive

Total entries: 24
First → latest: 02.2020 08.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
High 6
Medium 16
Low 1

Disclosures per year

2020: 1
2021: 2
2022: 2
2023: 0
2024: 1
2025: 2
2026: 16

22.07.2026

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

High CVE-2026-56745 >= 4.2.0.Final, < 4.2.16.Final, >= 4.1.0.Final, < 4.1.136.Final 4.2.16.Final, 4.1.136.Final
22.07.2026

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

High · 7.5 CVE-2026-55833 >= 4.2.0.Final, < 4.2.16.Final, >= 4.1.0.Final, < 4.1.136.Final 4.2.16.Final, 4.1.136.Final
22.07.2026

Netty SPDY SETTINGS frame count materializes unbounded settings map

High · 7.5 CVE-2026-55831 >= 4.2.0.Final, < 4.2.16.Final, >= 4.1.0.Final, < 4.1.136.Final 4.2.16.Final, 4.1.136.Final
07.05.2026

Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS

High · 7.5 CVE-2026-42587 >= 4.2.0.Alpha1, < 4.2.13.Final, < 4.1.133.Final 4.2.13.Final, 4.1.133.Final
07.05.2026

Netty has HttpClientCodec response desynchronization this entry

High · 7.3 CVE-2026-42584 >= 4.2.0.Alpha1, < 4.2.13.Final, < 4.1.133.Final 4.2.13.Final, 4.1.133.Final
26.03.2026

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

High · 7.5 CVE-2026-33870 < 4.1.132.Final, >= 4.2.0.Alpha1, < 4.2.10.Final 4.1.132.Final, 4.2.10.Final
21.02.2020

HTTP Request Smuggling in Netty

Critical · 9.1 CVE-2019-20444 < 4.1.44 4.1.44

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application