CVE-2026-100666: Netty HttpServerCodec Information Disclosure

CVE-2026-100666 Overview

CVE-2026-100666 is an HTTP response desynchronization vulnerability in Netty's HttpServerCodec (io.netty:netty-codec-http). The flaw affects versions 4.2.0.Final through 4.2.16.Final and all versions up to and including 4.1.136.Final. The codec incorrectly pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. A client that pipelines an HTTP/1.1 GET with an Expect: 100-continue header followed by a HEAD request can desynchronize the parser. This leads to HTTP response splitting, body misinterpretation, and unsafe connection reuse. The issue is tracked under [CWE-444] and fixed in 4.2.17.Final and 4.1.137.Final.

Critical Impact
Response desynchronization allows an attacker to misalign HTTP responses on reused connections, enabling response splitting and data exposure across pipelined requests.

Affected Products

Netty io.netty:netty-codec-http versions 4.2.0.Final through 4.2.16.Final
Netty io.netty:netty-codec-http versions up to and including 4.1.136.Final
Applications and frameworks embedding affected Netty HttpServerCodec releases

Discovery Timeline

2026-09-26 - CVE-2026-100666 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100666

Vulnerability Analysis

The vulnerability resides in how HttpServerCodec tracks pipelined HTTP/1.1 requests on a persistent connection. Netty maintains an internal queue of inbound request methods and calls pollMethod() once for every outbound response. This logic does not distinguish between final responses and 1xx informational responses such as 100 Continue. When a client sends a GET with an Expect: 100-continue header, the server emits a 100 Continue, which incorrectly consumes the queued GET method entry. The subsequent 200 OK for the GET is then paired with the next queued method, which is HEAD. Because HEAD responses must not carry a body, Netty drops the GET entity. The next 200 OK, intended for the HEAD, is then written with a body attached. The result is a parser-level desynchronization between client and server. The classification corresponds to HTTP Request/Response Smuggling under [CWE-444].

Root Cause

The root cause is an incorrect state transition in HttpServerCodec. The pollMethod() call fires for every response the server writes, including 1xx interim responses, instead of only for terminal 2xx-5xx responses. This off-by-one method queue consumption breaks the one-to-one mapping between pipelined requests and their final responses.

Attack Vector

An unauthenticated remote attacker can trigger the condition over the network by pipelining crafted HTTP/1.1 requests on a single keep-alive connection. The attacker sends a GET with Expect: 100-continue immediately followed by a HEAD request. The desynchronized responses can be observed or exploited by intermediaries, shared proxies, or other clients reusing the same connection, enabling response splitting and cross-request data exposure. No specific exploitation code is published in the referenced advisories; see the GitHub Security Advisory GHSA-2g6j-r8q9-5hr8 and the VulnCheck Security Advisory for Netty for technical details.

Detection Methods for CVE-2026-100666

Indicators of Compromise

Pipelined HTTP/1.1 request pairs where a GET carrying Expect: 100-continue is immediately followed by a HEAD request on the same connection.
Server access logs showing a 100 Continue response followed by a 200 OK for a HEAD request that unexpectedly contains a response body.
Client-side parse errors or truncated payloads from backends known to use Netty HttpServerCodec.

Detection Strategies

Inventory JVM applications and identify dependencies on io.netty:netty-codec-http within affected version ranges using Software Composition Analysis (SCA) tooling.
Inspect HTTP proxy and load balancer telemetry for responses where Content-Length or body bytes appear on HEAD responses.
Replay benign pipelined Expect: 100-continue plus HEAD sequences in staging to confirm whether the backend exhibits the desync behavior.

Monitoring Recommendations

Enable verbose HTTP logging at upstream proxies to capture per-connection request and response ordering.
Alert on reused keep-alive connections carrying HEAD responses with non-zero body length.
Track Netty version strings reported by server banners and dependency manifests across all internet-facing services.

How to Mitigate CVE-2026-100666

Immediate Actions Required

Upgrade io.netty:netty-codec-http to 4.2.17.Final or 4.1.137.Final, matching your current major line.
Audit transitive dependencies in Maven, Gradle, and SBT builds to ensure no older Netty version is pulled in by frameworks such as Spring WebFlux, Vert.x, Reactor Netty, or gRPC-Java.
Restart affected JVM services after dependency updates to flush any cached classloaders.

Patch Information

Netty maintainers resolved the issue in 4.2.17.Final and 4.1.137.Final. The fix corrects HttpServerCodec so that pollMethod() is not invoked for 1xx informational responses, preserving the one-to-one mapping between queued request methods and final responses. Full patch details are available in the GitHub Security Advisory GHSA-2g6j-r8q9-5hr8.

Workarounds

Disable HTTP/1.1 request pipelining or keep-alive on front-end proxies terminating client traffic before Netty backends.
Strip or reject inbound requests containing the Expect: 100-continue header at the edge until the upgrade is deployed.
Terminate TLS and HTTP parsing at a non-Netty reverse proxy that normalizes requests to the backend.

bash

# Example Maven dependency pin to the fixed release
# pom.xml
# <dependency>
#   <groupId>io.netty</groupId>
#   <artifactId>netty-codec-http</artifactId>
#   <version>4.1.137.Final</version>
# </dependency>
mvn dependency:tree | grep netty-codec-http