{"action":"Upgrade io.netty.incubator:netty-incubator-codec-bhttp to 0.0.23.Final or later.","affected":[{"fixed":"0.0.23.Final","introduced":"0"}],"component":"io.netty.incubator:netty-incubator-codec-bhttp","cve_ids":["CVE-2026-63124"],"ecosystem":"Maven","exploited":false,"fixed_versions":["0.0.23.Final"],"ghsa_id":"GHSA-8cfx-wx3q-mh5q","id":"tcs_01M5N8MFQGHFPW7853E595EC9Z","modified_at":"2026-08-20T19:11:03.770471Z","published_at":"2026-08-20T18:43:25Z","references":["https://osv.dev/vulnerability/GHSA-8cfx-wx3q-mh5q","https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-8cfx-wx3q-mh5q","https://github.com/netty/netty-incubator-codec-ohttp","https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-8cfx-wx3q-mh5q","url":"https://osv.dev/vulnerability/GHSA-8cfx-wx3q-mh5q"}],"summary":"netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary"}