Is io.netty.incubator:netty-incubator-codec-bhttp affected by CVE-2026-61827?

Maven io.netty.incubator:netty-incubator-codec-bhttp is affected in <= 0.0.22.Final.

Is CVE-2026-61827 being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

high

CVE-2026-61827

Q: Is CVE-2026-61827 being exploited?

Not on the CISA KEV list. EPSS exploit probability is not available.

Maven · io.netty.incubator:netty-incubator-codec-bhttp

Summary

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

Severity: high
CWE: CWE-400, CWE-770
Also known as: GHSA-hmq9-67w8-j5pw
Published: 2026-08-20
Updated: 2026-08-20

Advisory details

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.

References

Related advisories

GHSA-f48p-c9v4-h7xv — high · Go/github.com/labstack/echo/v4
CVE-2026-115776 — high · PyPI/Twisted
CVE-2026-115778 — high · PyPI/Twisted
CVE-2026-115775 — high · PyPI/Twisted
CVE-2026-114144 — high · npm/toml
CVE-2026-75508 — high · PyPI/graphql-core
CVE-2026-113729 — high · Go/github.com/moov-io/signedxml
CVE-2026-113711 — high · npm/apostrophe

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.