netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

published 2026-08-20 2mo ago modified 2026-08-20 2mo ago also GHSA-hmq9-67w8-j5pw

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.

Patch / fix

fixed in 1 links 1

maven io.netty.incubator:netty-incubator-codec-bhttp 0.0.23.Final

github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incub… release

Is CVE-2026-61827 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
maven	io.netty.incubator:netty-incubator-codec-bhttp	<0.0.23.Final	0.0.23.Final

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

GitHub Advisory GHSA-hmq9-67w8-j5pw

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.