HIGH 7.5 GitHub
CVE-2026-63124
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
## Summary
`io.netty.incubator:netty-incubator-codec-bhttp` can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using `BinaryHttpParser` / `BinaryHttpDecoder` can use a tiny malformed request or response to keep the parsing thread busy indefinitely, causing denial of service.
## Details
In `codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryH
Affected Products
- maven/io.netty.incubator:netty-incubator-codec-bhttp <= 0.0.22.Final
References
- https://github.com/advisories/GHSA-8cfx-wx3q-mh5q
- https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-8cfx-wx3q-mh
- https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-pa
- https://github.com/advisories/GHSA-8cfx-wx3q-mh5q
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-08-20 via GitHub. Affected: maven/io.netty.incubator:netty-incubator-codec-bhttp <= 0.0.22.Final.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.