Netty's HttpServerCodec implementation accepts an unbounded per-connection queue of pending HTTP/1.1 pipelined requests. An attacker can send many cached requests on a single connection while preventing read operations, causing the codec to grow the methodOverflowQueue without limit. This results in uncontrolled heap allocation and eventual denial of service for the running service.

Applications built with Netty’s io.netty:netty-codec-http component and running any of the following versions are vulnerable: 4.2.0.Final through 4.2.17.Final and all 4.1 releases up to and including 4.1.137.Final. The vulnerability is present in all builds that use the Netty HTTP server codec and has been fixed starting with 4.2.18.Final and 4.1.138.Final.

The CVSS score of 8.7 marks this flaw as high severity, and the EPSS score is not available, indicating that the exploitation likelihood is not quantified but remains significant. The issue is not listed in the CISA KEV catalog, yet it can be exploited remotely by an unauthenticated attacker who performs HTTP/1.1 pipelining against any service exposing a Netty HTTP handler. An attacker only needs to sustain a long-lived connection to drain memory resources, leading to a denial of service. The lack of a built‑in queue size limit and the absence of a rejection path increase the likelihood of successful exploitation when the target accepts large numbers of pipelined requests.