Netty is an asynchronous event-driven network application framework widely used for HTTP and other protocols.

A public GitHub Security Advisory (GHSA-pvjx-v7vp-62vq) reports that HttpServerCodec tracks, per connection, which HTTP method each still-unanswered pipelined request used. The first 32 pending entries are bit-packed into a single long, but every entry beyond that spills into methodOverflowQueue, an ArrayDeque with no upper bound.

A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on one connection while withholding reads can grow this queue without limit, causing unbounded heap growth and a memory-exhaustion denial of service. This is the same defect class previously fixed in the sibling class HttpContentEncoder (CVE-2026-59899); HttpServerCodec did not receive the equivalent pipeline-depth bound.

Affected package: io.netty:netty-codec-http
Affected versions: <= 4.1.137.Final and >= 4.2.0.Final, <= 4.2.17.Final
Fixed versions: 4.1.138.Final and 4.2.18.Final

Advisory: https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq