CVE-2026-59899 Details
Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
A denial-of-service vulnerability has been identified in Netty versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.136.Final. The issue arises in the `HttpContentEncoder` class, which is the superclass of the `HttpContentCompressor` handler. This class maintains a per-channel `ArrayDeque<CharSequence>` called `acceptEncodingQueue` that collects attacker-controlled data without any size restrictions. The queue is populated on the I/O thread with each incoming HTTP request and is only cleared when the application sends a non-1xx response. This behavior creates a resource exhaustion vulnerability, as an attacker can exploit HTTP/1.1 pipelining to overwhelm the connection with requests at a pace that exceeds the application's response rate.
Users can upgrade to Netty versions 4.1.136.Final or 4.2.16.Final to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/netty/netty/releases/tag/netty-4.1.136.Final | [email protected] | Release Notes |
| https://github.com/netty/netty/releases/tag/netty-4.2.16.Final | [email protected] | Release Notes |
| https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netty netty | < 4.1.136 >= 4.2.0, < 4.2.16 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | Initial Analysis | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |