Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final… (CVE-2026-100666)
Netty's HttpServerCodec in versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final contains a vulnerability where HTTP response parsing can become desynchronized. This occurs when a client sends a pipelined HTTP/1.1 GET request with an Expect: 100-continue header followed by a HEAD request. The 100 Continue response consumes the queued GET method incorrectly, causing the GET response body to be dropped and the HEAD response body to be misinterpreted as the GET body. This leads to response splitting and unsafe connection reuse. The issue is fixed in versions 4.2.17.Final and 4.1.137.Final.
AI Analysis
Technical Summary
The vulnerability in Netty's HttpServerCodec (io.netty:netty-codec-http) affects versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final. The codec pairs outbound responses with inbound requests by calling pollMethod() once per response, including for 1xx informational responses. When a client pipelines an HTTP/1.1 GET request with an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method prematurely. Consequently, the 200 OK response for the GET is paired with the HEAD request, causing the GET entity to be dropped and the HEAD response body to be sent with the GET response. This desynchronization results in response splitting and unsafe reuse of the HTTP connection. The flaw is addressed in versions 4.2.17.Final and 4.1.137.Final.
Potential Impact
This vulnerability can cause HTTP response desynchronization, leading to response splitting and unsafe connection reuse. The GET request's response body is never delivered, and the HEAD response body is misinterpreted as the GET response body. This can potentially lead to information disclosure or other unintended behaviors due to incorrect HTTP message parsing. The CVSS score is 7.3 (High), indicating a significant impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade affected Netty HttpServerCodec versions to 4.2.17.Final or later, or 4.1.137.Final or later, where the vulnerability is fixed. No other mitigation is indicated or required.
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final… (CVE-2026-100666)
Description
Netty's HttpServerCodec in versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final contains a vulnerability where HTTP response parsing can become desynchronized. This occurs when a client sends a pipelined HTTP/1.1 GET request with an Expect: 100-continue header followed by a HEAD request. The 100 Continue response consumes the queued GET method incorrectly, causing the GET response body to be dropped and the HEAD response body to be misinterpreted as the GET body. This leads to response splitting and unsafe connection reuse. The issue is fixed in versions 4.2.17.Final and 4.1.137.Final.
CVSS v3.1
Score 7.3high
Affected software
pkg:maven/io.netty/netty-codec-httpRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Netty's HttpServerCodec (io.netty:netty-codec-http) affects versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final. The codec pairs outbound responses with inbound requests by calling pollMethod() once per response, including for 1xx informational responses. When a client pipelines an HTTP/1.1 GET request with an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method prematurely. Consequently, the 200 OK response for the GET is paired with the HEAD request, causing the GET entity to be dropped and the HEAD response body to be sent with the GET response. This desynchronization results in response splitting and unsafe reuse of the HTTP connection. The flaw is addressed in versions 4.2.17.Final and 4.1.137.Final.
Potential Impact
This vulnerability can cause HTTP response desynchronization, leading to response splitting and unsafe connection reuse. The GET request's response body is never delivered, and the HEAD response body is misinterpreted as the GET response body. This can potentially lead to information disclosure or other unintended behaviors due to incorrect HTTP message parsing. The CVSS score is 7.3 (High), indicating a significant impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade affected Netty HttpServerCodec versions to 4.2.17.Final or later, or 4.1.137.Final or later, where the vulnerability is fixed. No other mitigation is indicated or required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jq5g-c66v-g3r2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100666"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ab89be0f7a7c54106942051
Added to database: 09/27/2026, 04:30:24 UTC
Last enriched: 09/27/2026, 04:42:52 UTC
Last updated: 09/28/2026, 01:47:40 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.