{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/netty-incubator-codec-bhttp/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-incubator-codec-bhttp","netty-incubator-codec-ohttp"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","netty"],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eThe \u003ccode\u003enetty-incubator-codec-bhttp\u003c/code\u003e library, used for decoding Binary HTTP (RFC 9292) messages, contains a critical control-flow defect in the \u003ccode\u003eBinaryHttpParser.readFieldSection\u003c/code\u003e method. The vulnerability arises from an improper loop termination condition (\u003ccode\u003efieldSectionLength != 0\u003c/code\u003e) and the failure to enforce forward progress when processing field lines.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated attacker can supply a malformed BHTTP request where the declared field-section length does not match the actual data. If the parser consumes zero bytes or consumes more bytes than declared, the loop enters an infinite busy-spin. Because the code relies on Java \u003ccode\u003eassert\u003c/code\u003e statements - which are stripped in production JVM environments - to guarantee termination and progress, the defect is fully exposed to remote exploitation. A small number of these requests can pin every available Netty event-loop thread at 100% CPU, resulting in a complete denial of service for OHTTP gateways or clients until the process is restarted.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains the target OHTTP gateway's public HPKE key configuration.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious BHTTP message where the declared field-section length is understated relative to the actual field line contents.\u003c/li\u003e\n\u003cli\u003eAttacker wraps the malicious BHTTP payload within a standard OHTTP request, encrypted with the gateway's public key.\u003c/li\u003e\n\u003cli\u003eOHTTP gateway receives the request and decrypts the chunk into the \u003ccode\u003ebinaryHttpCumulation\u003c/code\u003e buffer.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOHttpRequestResponseContext\u003c/code\u003e passes the attacker-controlled plaintext directly to \u003ccode\u003eBinaryHttpParser.parse\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eBinaryHttpParser\u003c/code\u003e enters the \u003ccode\u003ereadFieldSection\u003c/code\u003e method and triggers the vulnerable \u003ccode\u003ewhile\u003c/code\u003e loop (lines 619-626).\u003c/li\u003e\n\u003cli\u003eThe loop fails to terminate due to the \u003ccode\u003e!= 0\u003c/code\u003e condition or zero-byte progress, initiating an infinite CPU-bound spin.\u003c/li\u003e\n\u003cli\u003eRepeating the request exhausts the Netty event-loop group, leading to a total denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe attack results in an unauthenticated, persistent denial of service. By pinning the event-loop threads of an OHTTP gateway or client, the attacker renders the service incapable of accepting new connections or processing traffic. The impact is significant for high-availability infrastructure relying on Netty-based OHTTP gateways, as the service remains unavailable until manual intervention (process restart) occurs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003enetty-incubator-codec-bhttp\u003c/code\u003e to a version containing the patched \u003ccode\u003eBinaryHttpParser\u003c/code\u003e logic that replaces the vulnerable \u003ccode\u003ewhile\u003c/code\u003e loop with explicit exception handling.\u003c/li\u003e\n\u003cli\u003ePromote input validation invariants previously handled by \u003ccode\u003eassert\u003c/code\u003e (lines 622, 624) to explicit \u003ccode\u003eCorruptedFrameException\u003c/code\u003e checks to ensure security regardless of JVM assertion settings.\u003c/li\u003e\n\u003cli\u003eVerify that production deployments are not bypassing framing errors; ensure the parser enforces strict adherence to RFC 9292 regarding declared versus actual field-section length consumption.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-20T19:12:42Z","date_published":"2026-08-20T19:12:42Z","id":"https://feed.craftedsignal.io/briefs/2026-08-netty-bhttp-dos/","summary":"An infinite loop vulnerability in the BinaryHttpParser of netty-incubator-codec-bhttp allows unauthenticated attackers to exhaust event-loop threads and induce a persistent denial of service via specially crafted BHTTP requests.","title":"Unauthenticated CPU Exhaustion DoS in netty-incubator-codec-bhttp","url":"https://feed.craftedsignal.io/briefs/2026-08-netty-bhttp-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Incubator-Codec-Bhttp","version":"https://jsonfeed.org/version/1.1"}