CVE-2026-100666 Details
Description
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.
A response desynchronization vulnerability has been identified in Netty's HttpServerCodec component of the io.netty:netty-codec-http library. This issue affects versions 4.2.0.Final through 4.2.16.Final, as well as versions up to and including 4.1.136.Final. The vulnerability arises because the codec pairs outbound responses with inbound requests by calling pollMethod() for each response, including 1xx informational responses. When a client pipelines an HTTP/1.1 GET request with an Expect: 100-continue header followed by a HEAD request, the server's 100 Continue response consumes the queued GET method. As a result, the subsequent 200 OK response for the GET is incorrectly paired with the HEAD request, causing the GET response body to be dropped while the HEAD response is sent with a body. This misalignment disrupts HTTP parsing on the connection, leading to response splitting and unsafe connection reuse.
Users can upgrade to Netty versions 4.2.17.Final or 4.1.137.Final to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 26, 2026CISA-ADP
Assessed Sep 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/security/advisories/GHSA-2g6j-r8q9-5hr8 | CISA-ADP | AdvisoryExploitVendor |
| https://github.com/netty/netty/security/advisories/GHSA-2g6j-r8q9-5hr8 | [email protected] | AdvisoryExploitVendor |
| https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.17-response-desynchronization-via-httpservercodec | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Netty | >= 4.2.0.Final, <= 4.2.16.Final <= 4.1.136.Final |
CPE
Remediation
| |
| Netty HttpServerCodec | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 30, 2026 | CVE Modified | CISA-ADP |
| Sep 27, 2026 | CVE Modified | [email protected] |
| Sep 26, 2026 | New CVE Received | [email protected] |