CVE-2026-59899 Overview
CVE-2026-59899 is a resource exhaustion vulnerability in Netty, an asynchronous, event-driven network application framework widely used in Java-based servers and clients. The flaw affects HttpContentEncoder, the superclass of the production handler HttpContentCompressor, prior to versions 4.1.136.Final and 4.2.16.Final. The handler maintains a per-channel ArrayDeque<CharSequence> named acceptEncodingQueue that grows without a size limit. Attackers can exploit HTTP/1.1 pipelining to submit inbound requests faster than the server produces responses, causing unbounded memory growth on the I/O thread. The issue is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling].
Critical Impact
Remote unauthenticated attackers can trigger memory exhaustion and denial of service on Netty-based HTTP servers using pipelined requests.
Affected Products
- Netty versions prior to 4.1.136.Final
- Netty versions prior to 4.2.16.Final
- Applications using HttpContentCompressor or HttpContentEncoder handlers
Discovery Timeline
- 2026-07-29 - CVE-2026-59899 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-59899
Vulnerability Analysis
The vulnerability resides in Netty's HttpContentEncoder class, which is extended by the production compression handler HttpContentCompressor. For each channel, the handler creates an ArrayDeque<CharSequence> field called acceptEncodingQueue. This queue stores the Accept-Encoding header value from every inbound HTTP request so the handler can later select the appropriate compression scheme for the matching response.
The queue is populated on the Netty I/O thread every time an HTTP request arrives. It is drained only when the application emits a non-1xx response. If inbound requests arrive faster than the application produces responses, the queue grows without bound. Because no size cap, watermark, or backpressure signal governs the queue, an attacker controls how much memory the handler consumes per connection.
Root Cause
The root cause is the absence of any bound on acceptEncodingQueue. Netty accepts and stores attacker-supplied Accept-Encoding header values indefinitely, coupling request intake to response emission through an unbounded data structure. This is a classic instance of [CWE-770], where a shared resource is allocated on demand without throttling.
Attack Vector
An unauthenticated remote attacker opens a single TCP connection to a Netty HTTP server that has HttpContentCompressor in its pipeline. The attacker then uses HTTP/1.1 pipelining to send a continuous stream of small HTTP requests without waiting for responses. Each request adds an entry to acceptEncodingQueue. Because the I/O thread reads inbound bytes faster than the application layer produces responses, the queue grows on every pipelined request. Sustained pipelining leads to heap pressure, garbage collection thrashing, and eventual OutOfMemoryError conditions across the Java Virtual Machine (JVM).
No exploit code is publicly available in ExploitDB at the time of publication. Full technical details are documented in GitHub Security Advisory GHSA-q4f6-jm68-57ww.
Detection Methods for CVE-2026-59899
Indicators of Compromise
- Sustained heap growth on Java processes hosting Netty HTTP endpoints, without a corresponding rise in active application-level sessions.
- High volumes of pipelined HTTP/1.1 requests originating from a single source IP or small set of IPs.
- Frequent full garbage collection cycles and OutOfMemoryError events in application logs.
- Client connections that send many requests but never read responses.
Detection Strategies
- Inspect HTTP access logs for connections with abnormally high request counts per TCP session and low response read-back rates.
- Correlate JVM memory metrics with per-connection request counts to identify queue growth patterns.
- Alert when the ratio of inbound requests to emitted non-1xx responses on a single channel exceeds normal application baselines.
Monitoring Recommendations
- Export JVM heap and garbage collection metrics from Netty services to a centralized observability platform.
- Track per-connection request rates and pipelined request depth at the reverse proxy or load balancer.
- Monitor Netty channel counts, open file descriptors, and direct memory usage for anomalies.
How to Mitigate CVE-2026-59899
Immediate Actions Required
- Upgrade Netty to 4.1.136.Final or 4.2.16.Final in all affected applications and redeploy.
- Audit dependency trees for transitive Netty inclusions in frameworks such as Spring, gRPC, Vert.x, Play, and Reactor Netty.
- Restart services after upgrade to ensure that only patched Netty classes are loaded by the JVM.
Patch Information
The maintainers fixed the issue by bounding the acceptEncodingQueue and adding backpressure semantics. Patched releases are available at Netty 4.1.136.Final and Netty 4.2.16.Final. Review the GitHub Security Advisory GHSA-q4f6-jm68-57ww for the complete fix description.
Workarounds
- Terminate HTTP/1.1 pipelining at an upstream proxy that enforces a single in-flight request per connection.
- Enforce per-connection request rate limits and idle timeouts at the load balancer to close abusive pipelined sessions.
- Remove HttpContentCompressor from the pipeline where compression is not required, or move compression to a front-end proxy until patches are applied.
# Configuration example - upgrade Netty via Maven
mvn versions:use-dep-version -Dincludes=io.netty:netty-all -DdepVersion=4.1.136.Final -DforceVersion=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
