AIKIDO-2026-664762

TL;DR

This row consolidates the HTTP/1.x (netty-codec-http) security fixes in this release. GHSA-pvjx-v7vp-62vq: HttpServerCodec spills pipelined request methods into an unbounded overflow queue, so a client that pipelines many requests without reading responses exhausts heap. GHSA-2g37-3h88-55hc: WebSocketServerExtensionHandler keeps an unbounded per connection queue that grows one entry per request until an OutOfMemoryError. GHSA-rmcw-9fcq-wjq7: SpdySessionHandler places no limit on concurrent remote-initiated SPDY streams, allowing memory exhaustion. GHSA-rq4j-fc47-9698: chunk-extension validation runs only when a ; marker is present, so a carriage return in the chunk-size line bypasses it and enables request smuggling. GHSA-j4mg-hqgv-34qc: post-digit whitespace or control bytes in a chunk-size token are silently truncated, enabling smuggling. GHSA-hcvj-94mj-jp5c, GHSA-3jrc-fchc-59pw, and CVE-2026-89044 (GHSA-77qf-r755-9gcw): malformed or split Transfer-Encoding values where chunked is not the final coding are still treated as chunked, enabling request smuggling. GHSA-h75q-xqrh-59rf: RtspMethods.valueOf() trims trailing control bytes before lookup, letting method tokens such as PLAY\u0000 smuggle past upstream authorization. The fixes add pipeline, stream, and queue bounds and stricter chunk and Transfer-Encoding validation.