CVE-2026-100666

Name of the Vulnerable Software and Affected Versions Netty HttpServerCodec versions 4.2.0.Final through 4.2.16.Final Netty HttpServerCodec versions prior to 4.1.137.Final

Description Netty's HttpServerCodec pairs outbound responses with inbound requests by calling the pollMethod() function once per response, including for 1xx informational responses. When a client pipelines an HTTP/1.1 GET request containing an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method. Consequently, the subsequent 200 OK for the GET is paired with the HEAD request and its body is dropped, while the 200 OK for the HEAD request is written with a body. This leads to HTTP parsing desynchronization on the connection, where the GET entity is not delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse.

Recommendations Update to version 4.2.17.Final. Update to version 4.1.137.Final.