CVE-2026-100656

[CVE catalog]

Severity

High · CVSS 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Published

Sep 9, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 2:16:48 PM UTC

Source

[NVD] · [CVE record]

A flaw was found in Netty. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending numerous pipelined HTTP/1.1 requests over a single connection while withholding reads. Netty's HTTP server codec stores unanswered requests in an internal queue without a size limit, leading to excessive memory consumption and an eventual application crash. io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining This vulnerability is rated as an Important severity flaw because an unauthenticated network attacker can trigger an application-wide denial of service through memory exhaustion without needing prior credentials or complex preconditions. In Red Hat environments, Netty is widely bundled as an underlying network engine across middleware and containerized offerings, including Red Hat Build of Keycloak, Quarkus, and JBoss EAP. When HTTP/1.1 services accept pipelined requests, a malicious client can continuously send incoming queries over an individual connection while intentionally pausing consumption of server responses, consuming system heap until the Java virtual machine crashes. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.