A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-q4f6-jm68-57ww Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww cve-icon
https://netty.io/news/2026/07/09/4-1-136-Final.html cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-59899 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-59899 cve-icon
History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.
Title io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)
Weaknesses CWE-409
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Projects

Sign in to view the affected projects.

cve-icon MITRE

No data.

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-09T00:00:00Z

Links: CVE-2026-59899 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses