This vulnerability occurs in Netty's HttpClientCodec when exchanging HTTP responses. The codec wrongly associates a response with a queued request, causing body data to be incorrectly streamed and potentially corrupted. An attacker that controls the responding server can send a sequence of responses that misalign the client’s expectation, leading the client to read from the wrong offset and either drop data or misinterpret subsequent responses, which may cause a denial of service or data loss. The flaw is formally classified as CWE‑444, indicating a protocol handling weakness.

Affected products are Netty's core libraries, specifically the netty‑codec‑http module and the netty project itself. Versions prior to 4.2.13.Final for the 4.2 series and prior to 4.1.133.Final for the 4.1 series are vulnerable; upgrading to these patched releases removes the flaw.

The CVSS score of 7.3 indicates high severity. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation yet, but the flaw can be exploited by an attacker who controls the server communicating with a Netty client. The attack would likely involve sending a crafted sequence of HTTP responses to force the client into mis-synchronizing streams, potentially causing denial of service or incorrect data handling. As the flaw is in the client’s network codec, the remote target is a Netty-based application running on the client side.