{"action":"Upgrade io.netty.incubator:netty-incubator-codec-bhttp to 0.0.23.Final or later.","affected":[{"fixed":"0.0.23.Final","introduced":"0"}],"component":"io.netty.incubator:netty-incubator-codec-bhttp","cve_ids":["CVE-2026-61827"],"ecosystem":"Maven","exploited":false,"fixed_versions":["0.0.23.Final"],"ghsa_id":"GHSA-hmq9-67w8-j5pw","id":"tcs_01M5N90YZ132MCN3Y7RYY8JC5B","modified_at":"2026-08-20T19:11:03.631396Z","published_at":"2026-08-20T18:43:28Z","references":["https://osv.dev/vulnerability/GHSA-hmq9-67w8-j5pw","https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-hmq9-67w8-j5pw","https://github.com/netty/netty-incubator-codec-ohttp","https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-hmq9-67w8-j5pw","url":"https://osv.dev/vulnerability/GHSA-hmq9-67w8-j5pw"}],"summary":"netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields"}