Description

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-26T14:16:49.830Z",
  "pubdate": "2026-09-26T14:16:49.830Z",
  "executiveSummary": "Netty's HttpServerCodec contains a critical flaw in how it handles HTTP/1.1 response pairing, specifically when processing 1xx informational responses alongside pipelined requests.\nThe vulnerability allows an attacker to cause HTTP response desynchronization, leading to a state where response bodies are misaligned with their respective requests.\nAffected components include io.netty:netty-codec-http versions 4.2.0.Final through 4.2.16.Final and 4.1.x up to and including 4.1.136.Final.\nThe primary impact is potential response splitting and unsafe connection reuse, which may facilitate cache poisoning, credential theft, or the bypass of security controls by delivering content intended for one request to a different client request context.\nExploitation requires an attacker to possess the capability to send specific pipelined HTTP requests—specifically a GET request with an 'Expect: 100-continue' header followed by a HEAD request—over a single connection.\nThe risk is high, as this desynchronization breaks the integrity of the HTTP transaction stream, potentially exposing sensitive data or enabling application-level logic manipulation.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of the 'pollMethod()' function within 'io.netty:netty-codec-http'. This function is invoked to associate outbound responses with inbound requests to maintain the expected HTTP/1.1 pipeline order.\nIn the vulnerable versions, the codec incorrectly treats 1xx informational responses—such as '100 Continue'—as standard responses that consume a pending request method from the internal queue. When a client pipelines an HTTP/1.1 GET request containing an 'Expect: 100-continue' header, followed by a subsequent HEAD request, the server's codec inadvertently consumes the queued method for the GET request upon sending the 100 Continue informational response.\nBecause the '100 Continue' response triggers a premature poll operation, the internal state machine becomes desynchronized from the actual HTTP traffic flow.\nThe attack flow proceeds as follows: 1) The client sends a GET request with 'Expect: 100-continue'. 2) The server responds with '100 Continue', which erroneously causes the codec to poll the GET request out of the method queue. 3) The server finishes the GET request with a '200 OK' response, but since the queue has already been advanced, this response is logically paired with the HEAD request. 4) The actual '200 OK' for the HEAD request is subsequently written with a body. 5) This leads to a scenario where the original GET entity is never delivered to the client, and the body of the HEAD response is processed as the response body for the GET request.\nThis logic error results in persistent response desynchronization on the TCP connection. Subsequent requests reuse the connection in an inconsistent state, where the protocol handler no longer accurately maps headers to their corresponding payloads.\nThe impact is significant: the attacker can force the server to serve unauthorized content or cause the underlying application to interpret metadata as data, which may be exploited to bypass security filters, poison caches, or perform cross-protocol attacks.\nThis flaw is present in 'io.netty:netty-codec-http' and affects versions 4.2.0.Final to 4.2.16.Final and versions up to 4.1.136.Final, regardless of authentication, as it occurs at the protocol parsing layer."
}