{"action":"Upgrade io.netty.incubator:netty-incubator-codec-bhttp to 0.0.23.Final or later.","affected":[{"fixed":"0.0.23.Final","introduced":"0"}],"component":"io.netty.incubator:netty-incubator-codec-bhttp","cve_ids":["CVE-2026-61799"],"ecosystem":"Maven","exploited":false,"fixed_versions":["0.0.23.Final"],"ghsa_id":"GHSA-pgrf-4654-3gq8","id":"tcs_01M5N97E4Q2FGNDPNG7HTJ3AKJ","modified_at":"2026-08-20T19:11:03.566374Z","published_at":"2026-08-20T18:43:21Z","references":["https://osv.dev/vulnerability/GHSA-pgrf-4654-3gq8","https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-pgrf-4654-3gq8","https://github.com/netty/netty-incubator-codec-ohttp","https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-pgrf-4654-3gq8","url":"https://osv.dev/vulnerability/GHSA-pgrf-4654-3gq8"}],"summary":"netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash"}