Skip to main content

Netty CVE-2026-55831

HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-20 GitHub_M GHSA-6jqx-86gh-f27w
Denial Of Service Red Hat Suse Netty
7.5
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect to exposed SPDY/3.1 endpoint
  2. Delivery
    Craft ~2 MiB SETTINGS frame
  3. Exploit
    Declare max 24-bit entry count
  4. Execution
    Decoder materializes 262144 map entries
  5. Persist
    Repeat to exhaust heap/CPU
  6. Impact
    Service degradation or crash

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target must have Netty's SPDY/3.1 server codec enabled and reachable by the attacker - this is the exact prerequisite: a configured SpdyFrameDecoder/SPDY handler accepting untrusted peers. Given the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required against such a listener, and a single crafted SETTINGS frame suffices. The principal limiting factor is deployment: SPDY/3.1 is deprecated and rarely enabled, so services running only HTTP/1.1 or HTTP/2 are not exposed regardless of Netty version.
Impact

The supplied CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) is internally consistent with the description: remote, network-reachable, no authentication or user interaction, single well-formed frame, availability-only impact (no confidentiality or integrity loss). No EPSS score, KEV entry, or POC was provided, so exploitation is not confirmed to be occurring; the pure-availability impact and the fact that exploitation requires the target to have the SPDY/3.1 codec enabled make this a moderate, targeted-risk DoS rather than a widespread threat. The key limiting factor not captured by the raw CVSS score is deployment reality - SPDY/3.1 is deprecated and superseded by HTTP/2, so most Netty deployments do not expose the vulnerable handler. Treat as a real but conditional availability priority: high urgency for the small population running SPDY, low for everyone else.
Exploit ScenarioDerived

An attacker opens a SPDY/3.1 connection to an exposed Netty-backed service and sends one syntactically valid ~2 MiB SETTINGS frame declaring the maximum entry count. The server dutifully creates 262,144 map entries per frame, and repeated frames across connections rapidly exhaust heap and burn CPU on ordered-map insertions, degrading or crashing the service; no authentication or user interaction is required, though no public POC has been identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 20, 2026

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16.Final allows a remote unauthenticated peer to send a single ~2 MiB SPDY SETTINGS frame that forces the server to materialize 262,144 map entries in DefaultSpdySettingsFrame, driving heap growth and ordered-map insertion CPU cost far out of proportion to the input. Affected are Java services that enable Netty's SPDY handler and accept untrusted connections; there is no public exploit identified at time of analysis, and while CVSS is 7.5 the low EPSS-style real-world footprint is tempered by SPDY/3.1 being a deprecated, rarely-enabled protocol.

RemediationAI

Vendor-released patch: upgrade to Netty 4.1.136.Final or 4.2.16.Final, which bound the accepted SETTINGS entry count so an oversized frame is rejected rather than materialized. As a compensating control where immediate upgrade is not possible, disable the SPDY/3.1 handler and migrate clients to HTTP/2, since SPDY is deprecated - this removes the vulnerable code path entirely with the trade-off of dropping legacy SPDY client support. If SPDY must remain enabled, front the service with a reverse proxy or WAF that caps SPDY frame sizes or terminates SPDY, and constrain per-connection memory and enforce connection rate/size limits to blunt amplification, accepting the operational cost of the added tier. Refer to the advisory at https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w for authoritative guidance.

Affected Packages

maven io.netty:netty-codec-http fix: 4.1.136.Final, 4.2.16.Final

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in maven

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Netty is a widely used asynchronous event-driven network application framework for the JVM, providing codecs for numerous protocols including the now-deprecated SPDY/3.1. The flaw sits in the SPDY SETTINGS frame decoder: the SETTINGS frame carries a peer-declared entry count, and Netty trusted that count up to the 24-bit frame-length ceiling without validating it against the bytes actually available or a sane upper bound. Each declared unique setting ID is inserted into the ordered map backing DefaultSpdySettingsFrame, so a compact wire frame expands into hundreds of thousands of Java objects and map insertions. This is a textbook CWE-770 (Allocation of Resources Without Limits or Throttling) issue where attacker-controlled input directly governs allocation volume without a bound.

Know when Netty gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Single unauthenticated network frame triggers unbounded allocation with availability-only impact; requires SPDY handler enabled but no privileges, so PR:N and A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in DefaultSpdySettingsFrame, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 344 maven packages depend on io.netty:netty-codec-http (32 direct, 312 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

Executive ViewAI

Why It Matters

Netty framework versions before 4.1.136.Final and 4.2.16.Final contain a memory-amplification denial-of-service vulnerability (CVE-2026-55831, CVSS 7.5) affecting Java applications with SPDY/3.1 protocol support enabled. A remote attacker can send a single ~2 MiB SETTINGS frame that forces affected servers to exhaust heap memory and CPU, disrupting service availability. Real-world organizational risk is significantly constrained by SPDY/3.1 being a deprecated protocol rarely enabled in production environments.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Primary mitigation: disable SPDY/3.1 protocol support on Netty services where it is not required for business operations. Layered mitigations: restrict network access to Netty services via WAF or network segmentation; implement ingress filtering for abnormally large SETTINGS frames; enable heap monitoring and alerting to detect memory amplification attacks; consider disabling SPDY at load balancer level if upstream clients do not require it.

Threat Intelligence Overview

EPSS Score
0.6%
Top 54% exploitable
Prevalence
High
Netty underlies vast JVM ecosystem, but vulnerable SPDY codec rarely enabled
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Social Media
1
Sightings
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Affected Products (CPE)CVE.org

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2024-36121 CRITICAL POC
9.1 Jun 04

netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
CVE-2024-40642 HIGH POC
8.1 Jul 18

The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-59903 HIGH POC
7.5 Aug 17

Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final an
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:47172 ADVISORY https://access.redhat.com/errata/RHSA-2026:47189 ADVISORY https://access.redhat.com/errata/RHSA-2026:48118 ADVISORY https://vuldb.com/vuln/380799 REF https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b REF https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 REF https://github.com/netty/netty/releases/tag/netty-4.1.136.Final REF https://github.com/netty/netty/releases/tag/netty-4.2.16.Final REF https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy