CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
Attackers can desynchronize HTTP responses via pipelined requests, causing response splitting and unsafe connection reuse in Netty-based servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100666?
CVE-2026-100666 is a medium-severity vulnerability in netty, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.
Weakness: CWE-444
Which versions are affected by CVE-2026-100666?
How do I fix CVE-2026-100666?
No fix has been published for CVE-2026-100666 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100666 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100666 exists.
Sources
Also known as DEBIAN-CVE-2026-100666, GHSA-2g6j-r8q9-5hr8, GHSA-jq5g-c66v-g3r2, UBUNTU-CVE-2026-100666.