CVE-2026-59899

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description HttpContentEncoder (the superclass of the production handler HttpContentCompressor) maintains a per-channel ArrayDeque<CharSequence> named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and is only drained when the application writes a non-1xx response. An attacker can exploit HTTP/1.1 pipelining—a technique that allows sending multiple HTTP requests without waiting for the corresponding responses—to flood the connection with requests faster than the application can produce responses, leading to resource exhaustion.

Recommendations Update to version 4.1.136.Final. Update to version 4.2.16.Final.