MEDIUM 5.3 GitHub
CVE-2026-61799
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
## Summary
`io.netty.incubator:netty-incubator-codec-bhttp` uses attacker-controlled Binary HTTP variable-length integers as `long` values but accumulates them into `int` offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked `ArrayIndexOutOfBoundsException` / `IndexOutOfBoundsException` from a tiny malformed BHTTP payload. A remote peer can trigger connection-level denial of service in applications that expose `BinaryHttpParser` / `BinaryHttpDecoder` to unt
Affected Products
- maven/io.netty.incubator:netty-incubator-codec-bhttp <= 0.0.22.Final
References
- https://github.com/advisories/GHSA-pgrf-4654-3gq8
- https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-pgrf-4654-3g
- https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-pa
- https://github.com/advisories/GHSA-pgrf-4654-3gq8
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-08-20 via GitHub. Affected: maven/io.netty.incubator:netty-incubator-codec-bhttp <= 0.0.22.Final.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.