CVE-2026-100656

Executive Summary

CVE-2026-100656 is an unbounded memory consumption vulnerability in Netty's HttpServerCodec (io.netty:netty-codec-http) affecting versions 4.2.0.Final through 4.2.17.Final and all releases up to and including 4.1.137.Final. A remote, unauthenticated attacker can pipeline HTTP/1.1 requests on a single connection while withholding reads on their own end, causing the codec's internal methodOverflowQueue to grow without limit and exhaust heap memory. This results in a denial-of-service condition (CVSS 7.5, Availability: High) for any Java service exposing an HTTP/1.1 endpoint through the affected Netty codec.

Technical Analysis

Netty's HttpServerCodec tracks the HTTP method of each still-unanswered pipelined request to correlate responses with their originating requests. The implementation stores the first 32 request-method entries by bit-packing them into a single long value for efficiency. Any additional entries beyond that 32-entry threshold are appended to methodOverflowQueue, an ArrayDeque instance.

The core defect is CWE-770 (Allocation of Resources Without Limits or Throttling): methodOverflowQueue has no configured size limit and no rejection path. The codec does not enforce a maximum number of outstanding pipelined requests, does not cap the queue length, and does not terminate or reject the connection when the queue exceeds a safe threshold. As a result, the queue length is bounded only by available heap memory.

The attack leverages HTTP/1.1 pipelining semantics combined with TCP flow control. An attacker opens a single connection and sends a continuous stream of pipelined HTTP/1.1 requests without reading the corresponding responses. Because the attacker withholds reads on their end, TCP receive-window/back-pressure prevents Netty from flushing responses. However, request processing and method tracking continue: each additional unanswered request causes another method entry to be appended to methodOverflowQueue. Since responses are not being drained, entries accumulate rather than being removed, and the queue grows without bound. This produces unbounded heap growth, eventually triggering OutOfMemoryError, GC thrashing, or process termination — a classic remote denial-of-service condition.

The attack surface is any network-reachable HTTP/1.1 listener built on the affected Netty codec versions. The flaw requires no authentication (PR:N), no user interaction (UI:N), and is trivially reached over the network (AV:N) with low attack complexity (AC:L), consistent with the assigned CVSS vector. No confidentiality or integrity impact exists (C:N/I:N); only availability is affected (A:H).

Constraints and caveats: HTTP/1.1 pipelining support varies across clients, proxies, and servers, and some intermediaries may limit request depth or disable pipelining. The precise heap growth rate and the minimum request volume required to exhaust memory are environment-dependent (heap sizing, GC configuration, per-connection read settings) and cannot be stated precisely from the available description. No public proof-of-concept, exploit code, or Nuclei template is known at the time of writing.

Exploitation Scenarios

Note: No public PoC is available; the attack chain below is inferred from the vulnerability class described in the NVD entry.

1. Reconnaissance / target identification: The attacker identifies a Java-based service exposing an HTTP/1.1 endpoint that uses Netty's HttpServerCodec in an affected version (4.2.0.Final–4.2.17.Final or ≤4.1.137.Final). Identification may rely on service banners, response headers, error page fingerprints, or known Netty indicators exposed on the network.

2. Triggering the flaw class: The attacker establishes a single HTTP/1.1 connection and begins pipelining requests — sending multiple HTTP/1.1 requests back-to-back on the same connection without waiting for responses. The attacker deliberately does not read responses from the socket, applying back-pressure that prevents Netty from flushing responses and clearing tracked method entries. This is the mechanism that converts normal pipelining into unbounded queue growth.

3. Payload / execution method (vulnerability-class level): No crafted payload or memory-corruption primitive is required. The "payload" is simply the volume and pipeline depth of ordinary HTTP/1.1 requests sent on a connection the attacker refuses to drain. Once more than 32 unanswered pipelined requests accumulate, subsequent method entries are appended to methodOverflowQueue, which has no size limit and no rejection path. Continued request submission grows the queue until heap is exhausted.

4. Post-exploitation impact: Unbounded heap growth leads to degraded performance, GC pressure, and ultimately OutOfMemoryError or process termination — denial of service affecting all clients of the targeted service. Because the attacker needs only one connection and no credentials, the technique is cheap to execute and can be repeated. No data exfiltration or integrity modification is associated with this flaw.

Impact Assessment

The CVSS 3.1 base score is 7.5 (High). Subscore analysis based on the provided vector: Attack Vector Network (AV:N), Attack Complexity Low (AC:L), Privileges Required None (PR:N), User Interaction None (UI:N), Scope Unchanged (S:U), Confidentiality None (C:N), Integrity None (I:N), Availability High (A:H). The EPSS score is not yet assigned by FIRST.org, and CISA KEV status is NO — there is no evidence of known exploitation in the wild at this time.

Business impact centers on availability: services built on affected Netty versions can be rendered unavailable from a single unauthenticated remote connection. Blast radius is determined by deployment topology — any internet-facing or partner-facing Java HTTP/1.1 service using the affected codec is in scope. Because Netty is a widely embedded networking library, downstream products (API gateways, proxies, application servers, microservice frameworks) may inherit the vulnerability even without directly naming Netty. Recovery requires process restart in most cases, and repeated exploitation can sustain an outage. There is no data breach or integrity risk from this specific flaw.

Detection Guidance

Sigma Rule

title: Netty HttpServerCodec Unbounded Pipelined Request Queue Growth (CVE-2026-100656)
id: 7c9e2b41-0d6a-4f88-9b2e-1a3c5d7e9f10
status: experimental
description: Detects abnormally high volumes of pipelined HTTP/1.1 requests on a single connection consistent with CVE-2026-100656 methodOverflowQueue exhaustion attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100656
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: netty
detection:
  selection_status:
    http.response.status_code: 200
  selection_pipeline:
    http.request.method: 'GET'
  timeframe: 5m
  condition: selection_pipeline | count() by src_ip, src_port > 1000
falsepositives:
  - Legitimate high-throughput API clients using HTTP pipelining
  - Load testing or benchmarking traffic
level: medium
tags:
  - attack.t1499
  - cve.2026-100656

YARA Rule

rule CVE_2026_100656_Netty_MethodOverflowQueue
{
    meta:
        description = "Detects Netty codec artifacts and methodOverflowQueue references associated with CVE-2026-100656"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100656"
        date = "2026-01-01"
        severity = "high"

    strings:
        $netty1 = "io.netty" ascii wide
        $netty2 = "netty-codec-http" ascii wide
        $queue1 = "methodOverflowQueue" ascii wide
        $codec1 = "HttpServerCodec" ascii wide
        $ver1 = "4.2.17.Final" ascii wide
        $ver2 = "4.1.137.Final" ascii wide

    condition:
        uint32(0) == 0xCAFEBABE and
        (
            (any of ($netty*) and 1 of ($queue1, $codec1)) or
            ($queue1 and 1 of ($ver1, $ver2))
        )
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-100656 Netty HttpServerCodec Unbounded Pipelined Request Queue Growth"; flow:established,to_server; content:"HTTP/1.1"; depth:8; threshold:type both, track by_src, count 500, seconds 60; classtype:attempted-dos; reference:cve,2026-100656; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100656; sid:2026100656; rev:1;)

Elastic Detection

sequence by source.ip, destination.port with maxspan=5m
  [network where network.transport == "tcp" and destination.port in (80, 8080, 8443, 443) and network.packets > 0]
  [network where network.transport == "tcp" and destination.port in (80, 8080, 8443, 443)]
| where event_count > 1000

Splunk SPL Query

index=web OR index=network
| search "HTTP/1.1" AND (dest_port=80 OR dest_port=8080 OR dest_port=443 OR dest_port=8443)
| stats count AS req_count, dc(http_request_uri) AS distinct_uris BY src_ip, dest_ip, dest_port, src_port
| where req_count > 1000 AND distinct_uris >= 1
| sort - req_count

Wazuh OSSEC Rule

<group name="web,netty,cve_2026_100656,">
  <rule id="100656" level="10">
    <if_sid>31100</if_sid>
    <match>HTTP/1.1</match>
    <description>CVE-2026-100656: Possible Netty HttpServerCodec unbounded pipelined request queue growth (DoS attempt)</description>
    <group>attack,t1499,pci_dss_6.5.9,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Limit maximum concurrent pipelined requests per connection. If the server is fronted by a reverse proxy or load balancer, configure per-connection request limits, header/body limits, and mandatory keep-alive/pipelining caps, and disable HTTP/1.1 pipelining where feasible.
   • Enforce connection-level back-pressure and read timeouts so that slow-reading clients are disconnected rather than allowed to accumulate unanswered requests.
   • Rate-limit and cap total connections per source to reduce the ability to fan out the attack, and monitor heap usage per JVM to detect anomalous growth.
   • If HTTP/1.1 pipelining is not required by the application, disable it at the container or Netty pipeline configuration level.

2. Patch/upgrade steps:

   • Upgrade io.netty:netty-codec-http to 4.2.18.Final or 4.1.138.Final, which are the versions fixed per the advisory. Verify transitive Netty dependencies across embedded frameworks and shaded JARs so that the vulnerable codec version is not silently retained.
   • Rebuild and redeploy affected applications after the upgrade; restart JVMs to clear any existing heap pressure.

3. Long-term hardening:

   • Adopt dependency scanning that tracks Netty (and shaded/embedded copies) against known CVEs, and pin minimum safe versions.
   • Enforce resource-bounded design principles (CWE-770) in custom pipelines: always cap queues, buffers, and outstanding-request counters with explicit rejection paths.
   • Configure JVM heap limits, GC monitoring, and alerting on OutOfMemoryError and abnormal heap growth as part of baseline DoS resilience.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100656
• MITRE CWE-770: Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• FIRST CVSS 3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• Netty Project (io.netty:netty-codec-http): https://netty.io/
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

No known threat actor campaigns or exploit-in-the-wild evidence is associated with CVE-2026-100656 at this time; CISA KEV status is NO and no public PoC or Nuclei template is available.