Summary
A request-response desynchronization flaw in Netty's HttpServerCodec can incorrectly pair outbound HTTP responses with pipelined inbound requests when informational responses are present. Under a specific HTTP/1.1 request sequence, this may drop a response body, attach a body to a response that should not have one, and make connection reuse unsafe.
Affected context
The vulnerability occurs in applications using Netty's HTTP/1.1
HttpServerCodec with connection reuse and request pipelining enabled or
otherwise accepted. It becomes relevant when a client sends an
Expect: 100-continue request followed by a request with different body
semantics, such as HEAD, and the server emits informational and final
responses on the same connection.
Exploit preconditions
- Attack surface: Netty-based HTTP/1.1 server endpoints that support persistent connections
- Required access: Ability to send crafted, pipelined HTTP requests to the affected server
- Trigger point: Processing and response generation for an
Expect: 100-continuerequest followed by another request on the same connection - Why exploitation is possible: The codec consumes one queued request method for every outbound response, including informational responses, which can associate final responses with the wrong request
Why this happens
The underlying bug is inconsistent accounting between inbound requests and
outbound responses. HttpServerCodec calls pollMethod() once for each
response, even when the response is an informational 1xx message that
should not consume the request-to-response association.
This causes the codec's internal request queue to become misaligned with the
response stream. Later responses may inherit the method semantics of a
different request, causing an entity body to be suppressed or emitted
incorrectly. The behavior maps to CWE-444: Inconsistent Interpretation of HTTP Requests, commonly associated with request smuggling and HTTP
request-response desynchronization.
Potential impact
- A client may receive a response body associated with the wrong request.
- An expected response entity may be dropped or become unavailable.
- Proxies, clients, or downstream services may interpret connection data inconsistently.
- Persistent connection reuse could expose cross-request response confusion.
- Applications may experience data integrity, cache, or authorization boundary risks.
General mitigation guidance
Mitigation generally focuses on preserving consistent request-response
accounting and reducing ambiguity in HTTP connection handling.
Common defensive patterns include:
- Use a maintained codec implementation containing the relevant protocol-state correction.
- Treat informational responses as non-consuming for final request-response pairing.
- Apply strict, consistent parsing rules for request pipelining and connection reuse.
- Disable or limit HTTP/1.1 pipelining where it is not required.
- Normalize HTTP behavior consistently across reverse proxies, gateways, and application servers.
- Close or isolate connections when request or response framing becomes ambiguous.
- Test method-specific body handling, especially for
HEAD,Expect, and informational responses.
How teams detect issues like this
Organizations can identify this class of issue through:
- Dependency and component inventory checks for affected HTTP codec implementations.
- Protocol-state tests covering pipelined requests,
Expect: 100-continue,HEAD, and1xxresponses. - Integration tests that verify response ordering, method association, body presence, and persistent connection reuse.
- Code review checks for response logic that consumes request metadata for every response event.
- Runtime telemetry that detects unexpected response bodies, mismatched methods, or connection resets.
- Policy enforcement requiring HTTP parser consistency tests in CI and security review workflows.
