CVE-2026-61827: 
Java vulnerability analysis and mitigation

CVE-2026-61827 is a denial-of-service vulnerability in the netty-incubator-codec-ohttp library (Maven artifact io.netty.incubator:netty-incubator-codec-bhttp) caused by the BinaryHttpParser failing to enforce limits on encoded variable-length fields. All versions up to and including 0.0.22.Final are affected; the issue was fixed in 0.0.23.Final. The vulnerability was originally published on July 18, 2026 by maintainer normanmaurer and added to the GitHub Advisory Database on August 20, 2026. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The BinaryHttpParser in the Binary HTTP codec reads encoded variable-length integers that describe field sizes directly from the remote peer without imposing any upper bound, allowing an attacker to supply arbitrarily large length values and cause the server to buffer data indefinitely until the JVM runs out of heap memory (Out-of-Memory condition). No authentication, special privileges, or user interaction is required — any network-reachable peer communicating over the Binary HTTP protocol can trigger the condition (GitHub Advisory, Netty Security Advisory).

Successful exploitation results in a complete loss of availability for the affected service through an Out-of-Memory crash or severe memory pressure on the JVM hosting the Netty application. There is no impact on confidentiality or integrity of data. Because the condition can be triggered by any remote peer without authentication, internet-exposed services using the affected codec are at risk of being taken offline by a single malicious connection (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires no authentication, no special privileges, and no user interaction, making it trivially automatable against any exposed endpoint using the affected Binary HTTP codec. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been published at this time (GitHub Advisory).

1. Reconnaissance: Identify services using io.netty.incubator:netty-incubator-codec-bhttp version <= 0.0.22.Final by scanning for Binary HTTP (BHTTP) endpoints or reviewing publicly exposed dependency manifests (e.g., Maven POM files, SBOM disclosures).
2. Establish connection: Connect to the target service over the network using any Binary HTTP client capable of sending raw BHTTP-framed messages.
3. Craft malicious field length: Construct a Binary HTTP message where one or more field length values (encoded as variable-length integers per the BHTTP specification) are set to an extremely large value (e.g., close to Long.MAX_VALUE) without providing the corresponding data bytes.
4. Send payload: Transmit the crafted message to the target. The vulnerable BinaryHttpParser will read the oversized length value and begin buffering, waiting for the promised data that never arrives.
5. Trigger OOM: Repeat or sustain the connection as needed; the server's JVM heap will be exhausted as it buffers indefinitely, resulting in an OutOfMemoryError and service crash or severe degradation (GitHub Advisory, Netty Security Advisory).

• Logs: JVM logs showing java.lang.OutOfMemoryError: Java heap space or GC overhead limit exceeded errors originating from Netty pipeline threads; application logs showing stalled or hung Binary HTTP parsing operations.
• Process/Memory: Sustained and rapidly growing JVM heap usage visible in JVM monitoring tools (e.g., JConsole, VisualVM, Prometheus JVM metrics) without a corresponding increase in legitimate traffic load.
• Network: Persistent inbound connections from unexpected or unknown remote peers that send partial Binary HTTP messages and do not complete the exchange; connections that remain open for unusually long durations without completing a request/response cycle.

Upgrade the Maven dependency io.netty.incubator:netty-incubator-codec-bhttp to version 0.0.23.Final, which enforces limits on encoded variable-length field sizes in the BinaryHttpParser. No configuration-based workaround is documented; upgrading to the patched release is the only recommended remediation. Projects should update their pom.xml or build configuration to reference the patched version and redeploy affected services (GitHub Advisory, Netty Release).