MAVEN · AUGUST 2026 · EARLY WARNING

netty-incubator-codec-ohttp Vulnerability: CPU-Exhaustion DoS Risk

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected component: netty-incubator-codec-ohttp (maven)
Patched version: Not yet available

GHSA-4899-MPCH-38P3

An early warning has been issued for a high-severity vulnerability in the netty-incubator-codec-ohttp package that could allow unauthenticated CPU-exhaustion DoS attacks.

What happened

The netty-incubator-codec-ohttp package reportedly contains a vulnerability in its BinaryHttpParser component. This flaw can lead to an unauthenticated CPU-exhaustion denial-of-service (DoS) attack via an infinite loop during field-section decoding. The vulnerability is tracked as GHSA-4899-MPCH-38P3 and has a CVSS score of 7.5.

The affected versions are reported to be HEAD d3f2b49 (release 0.0.22.Final + 3 commits). There is no indication that this vulnerability has been exploited in the wild. Users of the netty-incubator-codec-ohttp package should monitor for any unusual CPU usage and consider applying patches as they become available.

What to do about it

Monitor your systems for any unusual CPU usage that could indicate an ongoing attack.
Consider applying patches as soon as they become available to mitigate the risk of CPU-exhaustion DoS attacks.
Consult the primary sources for the latest information and updates on this vulnerability.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If netty-incubator-codec-ohttp is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You may be affected if you are using the netty-incubator-codec-ohttp package with versions HEAD d3f2b49 (release 0.0.22.Final + 3 commits).

What should I do right now?

Monitor your systems for any unusual CPU usage and consider applying patches as soon as they become available.

Has an official fix been released?

No official fix has been published yet. Monitor the primary sources for updates.

Sources

Join the 0Day waitlist →

← Back to all threats