Bug 2541907 (CVE-2026-100666)

Summary:	CVE-2026-100666 io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anthomas, ant, anujha, aschwart, asoldano, asyoung, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, cmah, csuconic, dbruscin, dhanak, dlofthou, drichtar, drosa, dsimansk, ehelms, ehugonne, ewittman, fmariani, fmongiar, ggainey, gmalinko, gsmet, gtanzill, gtully, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jmartisk, jnethert, jpasqual, jpechane, jsherman, juwatts, jwon, kaycoth, kingland, kvanderr, manderse, mcarlett, mdellweg, mhulan, mnovotny, mosmerov, mposolda, msvehla, nipatil, nmoumoul, nwallace, olubyans, osousa, ozzy, pantinor, pberan, pcreech, pdelbell, pesilva, pjindal, pmackay, prichard, rchan, rgemmell, rgodfrey, rguimara, rkubis, rmartinc, rstancel, rstepani, sausingh, sbiarozk, sdawley, smallamp, ssilvert, sthirugn, sthorger, tbish, tcunning, thjenkin, tlavocat, tmalecek, varjain, vdosoudi, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Netty's HttpServerCodec. A remote attacker can exploit this vulnerability to cause HTTP response desynchronization, leading to response splitting and potential information disclosure. By sending pipelined requests with informational headers followed by another request, the server misaligns outbound responses with queued inbound requests. Consequently, response data can be associated with the wrong request on reused connections, leading to the delivery of unintended content.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-26 13:42:09 UTC

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.