CVE-2026-61827

priority · track · 0US

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

no CVSS

Is it mine?

1 products

Who says so?

1 sources

osv

No description recorded.

cvss

Technical severity, 0–10. One row per scoring source.

No CVSS score recorded.

The CWE weakness classes this flaw belongs to.

Products and version ranges known to be affected.

Maven io.netty.incubator:netty-incubator-codec-bhttp< 0.0.23.FinalosvUSpkg:maven/io.netty.incubator/netty-incubator-codec-bhttp

Vendor and ecosystem advisories describing this.

GHSA-hmq9-67w8-j5pwnetty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields2026-08-20ghsa · osvUS
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.

Which sources assert this record, and when.

published —modified —

External citations — patches, advisories, analysis.

No references recorded.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.