CVE-2026-61799

## Summary `io.netty.incubator:netty-incubator-codec-bhttp` uses attacker-controlled Binary HTTP variable-length integers as `long` values but accumulates them into `int` offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked `ArrayIndexOutOfBoundsException` / `IndexOutOfBoundsException` from a tiny malformed BHTTP payload. A remote peer can trigger connection-level denial of service in applications that expose `BinaryHttpParser` / `BinaryHttpDecoder` to untrusted input. ## Details In `codec-bhttp/src/main/java/io/netty/incubator/codec/bhttp/BinaryHttpParser.java`, several parser paths store cumulative byte offsets in `int sumBytes` and then add attacker-controlled `long` lengths using compound assignment. In Java, `int += long` narrows the result back to `int`, so a length such as `2^31` wraps `sumBytes` negative. Primary request-control-data path: - `readRequestHead(...)` declares `int sumBytes = 0` at `BinaryHttpParser.java:386`. - It reads `methodLength` as a `long` at `BinaryHttpParser.java:394`. - It performs `sumBytes += methodLength` at `BinaryHttpParser.java:395`, narrowing the result to `int`. - If `methodLength` is `2^31`, `sumBytes` wraps negative and bypasses `if (sumBytes >= in.readableBytes()) return null` at `BinaryHttpParser.java:396-398`. - The parser then computes `schemeLengthIdx = in.readerIndex() + sumBytes` and calls `in.getByte(schemeLengthIdx)` at `BinaryHttpParser.java:401-402`, producing a negative index exception. The same pattern is present in header parsing: - `readFieldLine(...)` uses `int sumBytes` and adds `long nameLength` / `long valueLength` at `BinaryHttpParser.java:659-680`. - `valueLengthIdx = nameIdx + (int) nameLength` at `BinaryHttpParser.java:674` can also overflow. `getIndeterminateLength(...)` similarly uses `int sumBytes` and `long possibleTerminator` at `BinaryHttpParser.java:544-553`. ## Proof of concept Safe local verification performed in this repository. After compiling