Netty's HttpServerCodec in versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final has a vulnerability where HTTP response parsing can become desynchronized. This occurs when a client sends a pipelined HTTP/1.1 GET request with an Expect: 100-continue header followed by a HEAD request. The 100 Continue response incorrectly consumes the queued GET method, causing the GET response body to be dropped and the HEAD response body to be misinterpreted as the GET body. This leads to response splitting and unsafe connection reuse. The issue is fixed in versions 4.2.17.Final and 4.1.137.Final.