ByteBuf reference leak in Netty SpdyHttpDecoder causes native memory exhaustion (CVE-2026-56745)

The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec fails to release a pooled `ByteBuf` when a stream is terminated via `RST_STREAM` or when accumulated content exceeds `maxContentLength`, permanently leaking native memory. A remote peer can trigger this condition repeatedly by opening SPDY streams and resetting them, leading to native memory exhaustion on the server. Affected versions: - >= 4.2.0.Final, <= 4.2.15.Final - >= 4.1.0.Final, <= 4.1.135.Final We recommend updating to: 4.2.16.Final, 4.1.136.Final. CVSS 8.7 · our assessment: this_week Reference: https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq Details: https://vuln.today/cve/CVE-2026-56745