THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-4899-mpch-38p3 (high) — netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

[GHSA] GHSA-4899-mpch-38p3 (high) — netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

medgithub_advisoriesPublished 2026-08-20

GHSA-4899-mpch-38p3 Severity: high CVE: CVE-2026-63202

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

# BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

- **ID:** BHTTP-LOOP-001 - **Severity:** High - **CVSS v3.1:** 7.5 — `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` -

Indicators of compromise

CVE-2026-63202cve
CVE-2024-40642cve

Original source: https://github.com/advisories/GHSA-4899-mpch-38p3