CVE-2026-59899

About vulnerability

Impact

HttpContentEncoder (the superclass of the production handler HttpContentCompressor) maintains a per-channel ArrayDeque<CharSequence> named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses.

Affected product:

Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Eclipse Jetty , Elasticsearch , Hazelcast , Netty , OpenSearch , Spring , Wildfly , alluxio , amazon-dynamodb-lock-client , amazon-kinesis-client , amazon-kinesis-producer , amqp-10-jms-spring-boot , appintegrations , applicationinsights-java , arrow , artemis , async-http-client , athenz , atomix-archive , avro , aws-glue-schema-registry , aws-lakeformation-accessgrants-plugin-java-v2 , aws-s3-accessgrants-plugin-java-v2 , aws-sdk-java , aws-sdk-java-v2 , azure-cosmosdb-java , azure-kusto-java , azure-sdk-for-java , azure-search-documents , azure-spring-data-cosmos , bolt-connection-java , bookkeeper , californium , camel , cassandra-java-driver , catalyst , chatbot , corda , corda-api , couchbase-jvm-clients , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , cypher-dsl , debezium , docker-java , etcd4j , finspace , flink , flink-shaded , flume , google-cloud-java , googleapis , grpc-java , hbase , hbase-thirdparty , http-client , ignite , incubator-retired-slider , infinispan , io.quarkus:quarkus-credentials-deployment , io.quarkus:quarkus-datasource-deployment-spi , io.quarkus:quarkus-resteasy , ivschat , jaeger-analytics-java , java-datastore , java-driver , java-logging , jena , jersey , jetcd , kinesis-logback-appender , lettuce , licensemanagerusersubscriptions , logging-flume , logging-flume-irc , metrics , micrometer , micronaut-core , neo4j , neo4j-java-driver , neo4j-ogm , neoscada , olingo-odata4 , opencensus-java , orc , org.apache.ratis:ratis-thirdparty-misc , org.eclipse.scada.protocols , parquet-java , partnercentralaccount , pgjdbc-ng , pinecone-java-client , pravega , pulsar , pulsar-client-reactive , qpid-jms , quarkus , rabbitmq-java-client , rabbitmq-stream-java-client , ratis , redisson , ribbon , rsocket-java , rxnetty , sdk-platform-java , smallrye-common , smallrye-fault-tolerance , smallrye-mutiny-vertx-bindings , smallrye-reactive-messaging , software.amazon.awssdk:applicationcostprofiler , software.amazon.awssdk:apptest , software.amazon.awssdk:bcmpricingcalculator , software.amazon.awssdk:cleanroomsml , software.amazon.awssdk:evs , software.amazon.awssdk:iotdeviceadvisor , software.amazon.awssdk:odb , software.amazon.awssdk:rbin , software.amazon.awssdk:wickr , strimzi-kafka-operator , synthetics , testcontainers-java , tika , tinkerpop , trendrrnsqclient , turbine , vert.x , vertx-auth , vertx-eventbus-bridges , vertx-grpc , vertx-kafka-client , vertx-web , voiceid , zendesk-java-client , zookeeper

Affected packages:

zookeeper @ 3.6.4 (+25782 more)