High 7.3Published Sep 26, 2026

CVE-2026-100666Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

Updated under an hour ago (2026-10-19 09:10 UTC)

Does this affect you?

It affects netty. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.24%, higher than 14% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for netty

Exploited in the last 30 days

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.

CVSS: 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE): CWE-444
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.24% (percentile 14)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Sep 30, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

netty netty netty:netty (from the name)	from 4.2.0.Final before 4.2.17.Final; 4.2.17.Final not affected	CNA record

References

https://github.com/netty/netty/security/advisories/GHSA-2g6j-r8q9-5hr8vendor-advisory
https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.17-response-desynchronization-via-httpservercodecthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.