CVE-2026-59899¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Netty's HttpContentEncoder (the superclass of HttpContentCompressor) maintains a per-channel acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response, allowing resource exhaustion when an attacker uses HTTP/1.1 pipelining to flood a connection faster than the application produces responses. Fixed in 4.1.136.Final and 4.2.16.Final.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
A single Netty distribution reaches the runtime in WSO2 Identity Server, shipped as a WSO2 orbit bundle that re-wraps an upstream release within the affected range. The vulnerable class is therefore physically present, and this finding turns entirely on whether it is reachable.
The content compressor is never used. The only other reference is unused. The single copy of this class name outside the Netty bundle appears in the Vert.x core classes inlined into the Vert.x JSON Schema bundle. Its one consumer, the OAuth Rich Authorization Requests component, uses Vert.x purely for JSON schema validation (JsonSchema, SchemaRepository, Validator, JsonObject, FileSystem) and never touches its HTTP API; io.vertx.core.http.HttpServer is referenced by nothing in the distribution.
The defect requires a running Netty HTTP server flooded with pipelined HTTP/1.1 requests, and no Netty server is started.
No Netty HTTP server is ever started. io.netty.handler.codec.http.HttpServerCodec and io.netty.handler.codec.spdy.SpdyFrameCodec are referenced by nothing in the shipped distribution, so no Netty server pipeline is ever built. WSO2 Identity Server serves all inbound HTTP through embedded Apache Tomcat, configured in repository/conf/tomcat/catalina-server.xml.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.