CVE-2026-61799: 
Java vulnerability analysis and mitigation

CVE-2026-61799 is a denial-of-service vulnerability in the io.netty.incubator:netty-incubator-codec-bhttp library, caused by an unchecked integer overflow in the Binary HTTP (BHTTP) parser. Attacker-controlled variable-length integers (varints) are read as long values but accumulated into int offsets, causing wraparound to negative values and triggering unchecked ArrayIndexOutOfBoundsException or IndexOutOfBoundsException. All versions up to and including 0.0.22.Final are affected; the fix is available in 0.0.23.Final. The vulnerability was first published on July 12, 2026, and added to the GitHub Advisory Database on August 20, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an integer overflow/wraparound (CWE-190) combined with incorrect numeric type conversion (CWE-681) and an uncaught exception (CWE-248) in BinaryHttpParser.java. Multiple parser paths — readRequestHead() (lines 386–402), readFieldLine() (lines 659–680), and getIndeterminateLength() (lines 544–553) — declare cumulative offset variables as int but add attacker-supplied long varint lengths via compound assignment (int += long), which Java silently narrows back to int. A crafted varint encoding 2^31 (e.g., 0xc000000080000000) causes sumBytes to wrap negative, bypassing the readable-bytes guard and producing a negative buffer index that triggers an unhandled exception. A public proof-of-concept using a 15-byte payload is included in the advisory, demonstrating the crash with output java.lang.ArrayIndexOutOfBoundsException: Index -2147483639 out of bounds for length 15 (GitHub Advisory, Netty Security Advisory).

Exploitation causes the affected Netty channel to close or fail, resulting in a connection-level denial of service for any application exposing BinaryHttpParser or BinaryHttpDecoder to untrusted network input. Repeated small malformed payloads (as few as 15 bytes each) can sustain service disruption. No memory corruption, confidentiality loss, or integrity impact was observed, as the failure occurs within Java/Netty bounds-checking mechanisms (GitHub Advisory).

A public proof-of-concept payload is included in the official security advisory, making exploitation straightforward for any attacker with network access to an exposed BHTTP endpoint. No authentication or user interaction is required, and attack complexity is low. There is no current evidence of in-the-wild exploitation, no CISA KEV listing, and no threat actor attribution at this time. The CVE status remains "Reserved" and EPSS data is not yet available (GitHub Advisory).

1. Reconnaissance: Identify services using io.netty.incubator:netty-incubator-codec-bhttp version <= 0.0.22.Final that accept Binary HTTP (BHTTP) connections from untrusted clients.
2. Craft malformed payload: Construct a 15-byte BHTTP payload with a known-length request frame indicator (0x00) followed by a valid 8-byte varint encoding of 2^31 (0xc000000080000000) as the method length, plus a few dummy bytes (e.g., 0x47 0x45 0x54 0x58 0x58 0x58).
3. Send payload: Transmit the crafted payload to the target's BHTTP endpoint over the network — no credentials or prior session required.
4. Trigger crash: The parser's readRequestHead() method accumulates the long varint into an int sumBytes, causing integer wraparound to a large negative value, bypassing the readable-bytes guard, and producing an ArrayIndexOutOfBoundsException.
5. Achieve DoS: The uncaught exception closes or fails the Netty channel. Repeating the payload causes sustained denial of service for the BHTTP endpoint (GitHub Advisory, Netty Security Advisory).

• Logs: Java stack traces containing java.lang.ArrayIndexOutOfBoundsException or java.lang.IndexOutOfBoundsException with large negative index values (e.g., Index -2147483639 out of bounds) originating from io.netty.incubator.codec.bhttp.BinaryHttpParser.
• Network: Repeated small (~15-byte) inbound BHTTP connections or frames from the same or rotating source IPs, particularly those that result in immediate channel closure.
• Application Behavior: Sudden or repeated Netty channel failures/closures on BHTTP-exposed endpoints without corresponding legitimate client errors; elevated channel error rates in application metrics (GitHub Advisory).

Upgrade io.netty.incubator:netty-incubator-codec-bhttp to version 0.0.23.Final, which is available via the netty-incubator-codec-parent-ohttp-0.0.23.Final release. No configuration-based workaround is available; the fix requires using long for all cumulative byte counts, adding checked arithmetic before any int conversion, and throwing controlled CorruptedFrameException or TooLongFrameException for invalid lengths. As an interim measure, restrict network access to BHTTP endpoints to trusted clients only (GitHub Advisory, Netty Release).

The vulnerability was reported by Thai Son Dinh from VinSOC Labs (R&D) and published by Netty maintainer normanmaurer on July 12, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (Netty Security Advisory).