Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-29 | 2 | General2 |
| 2026-08-08 | 1 | General1 |
🟠 Netty HttpContentEncoder Unbounded Queue Growth via HTTP/11 Pipelining - #CVE-2026-59899 (MEDIUM) -DC-Aug2026-1462 https://dailycve.com/netty-httpcontentencoder-unbounded-queue-growth-via-http-11-pipelining-cve-2026-59899-medium-dc-aug2026-1462/
Post summary
Link to a dailycve article announcing CVE-2026-59899 with no further details or actionable information provided.
🚨*CVE* CVE-2026-59899 Netty is an asynchronous, event-driven network application framework. Prior to versions http://4.1.136.Final and http://4.2.16.Final, `HttpContentEncoder` (the superclass of the pr… https://www.cve.org/CVERecord?id=CVE-2026-59899 ----- Traducció… http://infoflow.cloud`
Post summary
The post references CVE‑2026‑59899 affecting Netty, mentioning specific versions and a CVE record link, but provides no technical details, exploits, patches, or evidence of active exploitation.
CVE-2026-59899 Netty is an asynchronous, event-driven network application framework. Prior to versions http://4.1.136.Final and http://4.2.16.Final, `HttpContentEncoder` (the superclass of the pr… https://www.cve.org/CVERecord?id=CVE-2026-59899
Post summary
The post notes CVE-2026-59899 impacts Netty before certain versions, but provides no additional technical detail, PoC, exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | netty | netty | - | - | - |