CVE-2026-61827

highcovered by 1 sourcefirst seen 2026-08-20

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM.

⚡ Watch CVE-2026-61827

Get an email if CVE-2026-61827 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highGHSA-hmq9-67w8-j5pw: netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths …ghsa · 2026-08-20

External references

NVD record for CVE-2026-61827

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-61827 status](https://www.csirts.com/badge/CVE-2026-61827)](https://www.csirts.com/cve/CVE-2026-61827)