SPDY zlib header decompression amplification DoS in Netty (CVE-2026-55833)

Netty's SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated. A remote unauthenticated peer can send a small compressed HEADERS block that expands into much larger raw header data, causing compression-amplified CPU and allocation churn. The impact is denial of service against any Netty pipeline containing `SpdyFrameCodec`. Affected versions: - >= 4.2.0.Final, <= 4.2.15.Final - >= 4.1.0.Final, <= 4.1.135.Final We recommend updating to: 4.2.16.Final, 4.1.136.Final. CVSS 7.5 · our assessment: this_week Reference: https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c Details: https://vuln.today/cve/CVE-2026-55833