CVE-2026-100666

Executive Summary

CVE-2026-100666 is a request/response desynchronization flaw (HTTP request smuggling class, CWE-444) in Netty's HttpServerCodec (io.netty:netty-codec-http). It affects Netty versions 4.2.0.Final through 4.2.16.Final and versions up to and including 4.1.136.Final. The flaw allows a client that pipelines an HTTP/1.1 GET with Expect: 100-continue followed by a HEAD request to desynchronize HTTP parsing, causing the GET entity to be dropped and the HEAD response body to be interpreted as the GET body. This enables response splitting and unsafe connection reuse. CVSS score: 7.3 (High). No public PoC, nuclei template, or exploit code is currently available, and the CVE is not listed in CISA KEV.

Technical Analysis

The vulnerability resides in Netty's HttpServerCodec, a composite handler combining HttpRequestDecoder and HttpResponseEncoder. The root cause is in the codec's outbound response handling: it pairs each outbound response with an inbound request by calling pollMethod() once per response written to the channel. This method is invoked for every response, including 1xx informational responses such as 100 Continue.

HTTP/1.1 defines 100 Continue as an informational status code used with the Expect: 100-continue request header. When a client sends a GET request with Expect: 100-continue, the server is expected to emit a 100 Continue response to signal the client to proceed with the body, then later emit the final response (e.g., 200 OK). The codec's method-pairing logic does not distinguish between informational (1xx) responses and final responses. As a result, the 100 Continue response consumes the method token queued for the GET request.

The NVD description provides the following concrete sequence:

1. A client pipelines an HTTP/1.1 GET carrying Expect: 100-continue followed by a HEAD request.
2. The 100 Continue response for the GET consumes the queued GET method from the codec's tracking queue.
3. The subsequent 200 OK for the GET is then paired with the HEAD method instead of GET. Because HEAD responses carry no message body by specification, the codec drops the GET entity's body.
4. The following 200 OK for the HEAD request is written with a body (because it is paired with the GET method), violating HEAD semantics.
5. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered, and the HEAD response body is interpreted as the GET body.

The security consequence is response splitting and unsafe connection reuse. Because the method-to-response binding is shifted by one, an attacker can manipulate how a shared connection (e.g., a proxy or reverse proxy fronting the Netty server, or a keep-alive connection between the client and origin) interprets response boundaries. This is the HTTP response splitting / request smuggling class (CWE-444: Inconsistent Interpretation of HTTP Requests). The attack surface is any Netty-based HTTP server or client using HttpServerCodec that supports connection keep-alive and processes pipelined requests, particularly in deployments behind caching proxies, load balancers, or CDNs that reuse backend connections across users.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction, with limited confidentiality, integrity, and availability impact. The scope is unchanged, meaning the impact is confined to the vulnerable component's security authority. Limited confidentiality reflects potential leakage of one user's response to another (the HEAD body interpreted as the GET body); limited integrity reflects attacker-influenced response pairing; limited availability reflects possible connection corruption or dropped entities.

No public exploit code or nuclei template is available as of this writing. The vulnerability class is well understood, but the specific Netty implementation details required for a reliable exploit—such as exact timing of pollMethod() invocation relative to chunked encoding and the precise behavior of the pipeline—would require independent research. No specific function names, endpoints, or parameters beyond pollMethod() and HttpServerCodec are provided in the NVD description, so implementation-level claims beyond those are not made here.

Exploitation Scenarios

Reconnaissance / target identification: An attacker identifies a target running a Netty-based HTTP server. Netty is widely embedded in frameworks (e.g., Spring WebFlux, gRPC-Java, various API gateways, and custom services) and may be identified via server banners, error pages, TLS characteristics, or behavioral fingerprinting. The attacker also needs to determine whether the deployment sits behind a shared backend connection pool (proxy, load balancer, CDN) that reuses connections across clients, since the impact is greatest in that topology.

Flaw trigger: The attacker sends a single TCP connection carrying pipelined HTTP/1.1 requests: first a GET request with the header Expect: 100-continue, immediately followed by a HEAD request. Because the requests are pipelined, the server processes both on the same connection. The 100 Continue informational response consumes the queued GET method in the codec's pairing logic. The final 200 OK for the GET is then paired with HEAD, causing its body to be dropped, and the 200 OK for the HEAD is emitted with a body.

Payload/execution method: No public PoC is available; the attack chain is inferred from the vulnerability class and the sequence described in the NVD entry. At the vulnerability-class level, the attacker crafts a request stream that intentionally triggers the informational-response/method-pairing mismatch. The attacker does not need to inject malicious payloads into the Netty server itself; the desynchronization is triggered by a well-formed but adversarial request sequence. The attacker may refine timing and headers (e.g., manipulating body lengths, Content-Length, or chunked encoding) to steer how the desynchronized response is parsed by an intermediary or downstream consumer.

Post-exploitation impact: The primary consequence is response splitting and unsafe connection reuse. In a shared-connection deployment, one client's response body (the HEAD response containing a body) may be delivered to another client whose request is paired onto the same backend connection. This can result in cache poisoning (a proxy caches a response under the wrong request key), information disclosure (one user receives another user's response body), and request smuggling (a request is interpreted differently by the front-end proxy and the Netty backend). Depending on what the exposed endpoints return, this can escalate to session hijacking, access-control bypass, or targeted data exfiltration. The CVSS subscores (C:L/I:L/A:L) indicate limited but real impact across all three pillars.

Impact Assessment

Business impact centers on integrity and confidentiality of HTTP transactions in Netty-based services, especially those behind reverse proxies, load balancers, or CDNs that reuse backend connections. Affected systems include any application embedding io.netty:netty-codec-http in the affected version ranges (4.2.0.Final–4.2.16.Final and ≤4.1.136.Final), including Java microservices, API gateways, and gRPC/HTTP servers. The blast radius is proportional to connection reuse: single-client, non-pipelining deployments have minimal exposure, while fronted, connection-pooled deployments can expose many users to one another's responses. CVSS 7.3 (High) with AV:N/AC:L/PR:N/UI:N means remote, unauthenticated exploitation with no user interaction; C:L/I:L/A:L reflects limited leakage, response manipulation, and possible connection disruption. Because no EPSS score or KEV listing exists, the immediate exploitation likelihood is assessed as low-to-moderate pending public tooling, but the impact class (response splitting/smuggling) is historically high-value for attackers targeting caches and auth boundaries.

Detection Guidance

Sigma Rule

title: Potential Netty HttpServerCodec Response Desynchronization (CVE-2026-100666)
id: 3f8c2a1e-9b47-4d2e-a6c1-7e5b1d9f0a34
status: experimental
description: Detects HTTP requests pipelining a GET with Expect 100-continue followed by a HEAD request, a pattern associated with Netty HttpServerCodec response desynchronization.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100666
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: netty
detection:
  selection_expect:
    cs-method: 'GET'
    cs-header|contains: 'Expect: 100-continue'
  selection_head:
    cs-method: 'HEAD'
  condition: selection_expect and selection_head
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-header
falsepositives:
  - Legitimate clients using Expect 100-continue with HEAD
level: medium
tags:
  - attack.t1190
  - cve.2026.100666

YARA Rule

rule CVE_2026_100666_Netty_HttpServerCodec_Desync
{
    meta:
        description = "Detects HTTP request streams pipelining Expect 100-continue GET followed by HEAD, targeting Netty HttpServerCodec desync"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100666"
        date = "2026-01-01"
        severity = "high"
    strings:
        $expect = "Expect: 100-continue" nocase
        $expect2 = "Expect:100-continue" nocase
        $get = "GET " nocase
        $head = "HEAD " nocase
    condition:
        filesize < 64KB and
        (any of ($expect*)) and
        $get and $head
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-100666 Netty HttpServerCodec Response Desync Attempt"; flow:established,to_server; content:"Expect: 100-continue"; nocase; content:"HEAD "; nocase; distance:0; within:512; classtype:attempted-admin; reference:cve,2026-100666; sid:2026100666; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "GET" and http.request.headers contains "Expect: 100-continue" ]
  [ network where http.request.method == "HEAD" ]
| where source.ip is not null

Splunk SPL Query

index=web sourcetype=netty OR sourcetype=access_combined
| rex field=request_header "(?i)Expect:\s*100-continue"
| where match(http_method, "GET") AND match(expect_header, "(?i)100-continue")
| transaction clientip maxspan=5s
| search http_method="HEAD"
| table _time clientip http_method uri expect_header

Wazuh OSSEC Rule

<group name="web,netty,cve-2026-100666">
  <rule id="100666" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="method">GET</field>
    <match>Expect: 100-continue</match>
    <description>CVE-2026-100666: Possible Netty HttpServerCodec response desync - GET with Expect 100-continue detected; watch for pipelined HEAD</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100666,</group>
  </rule>
  <rule id="100667" level="12">
    <if_sid>100666</if_sid>
    <field name="method">HEAD</field>
    <same_source_ip />
    <timeframe>5</timeframe>
    <description>CVE-2026-100666: GET(Expect 100-continue) followed by HEAD from same source - potential response desynchronization exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_100666,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Disable HTTP pipelining at any front-end proxy or load balancer; enforce one in-flight request per backend connection where possible.
   • Configure proxies to normalize or reject ambiguous request sequences, specifically 1xx informational responses combined with Expect: 100-continue.
   • Disable Expect: 100-continue handling at the edge and require clients to send bodies without the expectation, if the application permits.
   • Avoid reusing backend connections across distinct clients (disable connection pooling or scope pools per client/session) to eliminate the cross-user impact of response splitting.
   • Monitor and rate-limit connections that send pipelined GET→HEAD sequences with Expect: 100-continue.

2. Patch/upgrade steps:

   • The NVD description states the flaw is fixed in Netty 4.2.17.Final and 4.1.137.Final. Upgrade io.netty:netty-codec-http to one of these versions and rebuild/redeploy dependent applications.
   • Note: no patch source is tracked in the intelligence feed (patch confidence 0/4); verify the availability of these versions directly from the Netty project before relying on the fix.
   • Audit transitive dependencies (Spring Boot, gRPC-Java, Vert.x, and other Netty-embedding frameworks) and update them to versions that pull in the fixed Netty codec.

3. Long-term hardening:

   • Enforce strict HTTP/1.1 message framing at intermediaries and reject responses that violate HEAD semantics (body present on HEAD responses).
   • Implement response/request pairing validation in custom Netty pipelines and monitor for desynchronization indicators.
   • Adopt end-to-end request smuggling detection (e.g., header normalization, Content-Length/chunked consistency checks) at the reverse proxy.
   • Maintain an SBOM and continuous dependency scanning to catch Netty version drift, since the library is a common transitive dependency.

References

• NVD — CVE-2026-100666: https://nvd.nist.gov/vuln/detail/CVE-2026-100666
• CWE-444: Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling): https://cwe.mitre.org/data/definitions/444.html
• Netty project (official release/security advisory channel): https://netty.io/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-100666 at the time of writing; no public PoC, nuclei template, or exploit code is available, and the CVE is not listed in CISA KEV.