Netty
CVE-2026-55831
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Single unauthenticated network frame triggers unbounded allocation with availability-only impact; requires SPDY handler enabled but no privileges, so PR:N and A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in DefaultSpdySettingsFrame, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
AnalysisAI
Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16.Final allows a remote unauthenticated peer to send a single ~2 MiB SPDY SETTINGS frame that forces the server to materialize 262,144 map entries in DefaultSpdySettingsFrame, driving heap growth and ordered-map insertion CPU cost far out of proportion to the input. Affected are Java services that enable Netty's SPDY handler and accept untrusted connections; there is no public exploit identified at time of analysis, and while CVSS is 7.5 the low EPSS-style real-world footprint is tempered by SPDY/3.1 being a deprecated, rarely-enabled protocol.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must have Netty's SPDY/3.1 server codec enabled and reachable by the attacker - this is the exact prerequisite: a configured SpdyFrameDecoder/SPDY handler accepting untrusted peers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) is internally consistent with the description: remote, network-reachable, no authentication or user interaction, single well-formed frame, availability-only impact (no confidentiality or integrity loss). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker opens a SPDY/3.1 connection to an exposed Netty-backed service and sends one syntactically valid ~2 MiB SETTINGS frame declaring the maximum entry count. The server dutifully creates 262,144 map entries per frame, and repeated frames across connections rapidly exhaust heap and burn CPU on ordered-map insertions, degrading or crashing the service; no authentication or user interaction is required, though no public POC has been identified. |
| Remediation | Vendor-released patch: upgrade to Netty 4.1.136.Final or 4.2.16.Final, which bound the accepted SETTINGS entry count so an oversized frame is rejected rather than materialized. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Java services running Netty versions prior to 4.1.136.Final and 4.2.16.Final to identify which deployments have SPDY/3.1 handler enabled on internet-facing interfaces. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan
Netty project is an event-driven asynchronous network application framework. Rated medium severity (CVSS 6.5), this vuln
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan
Netty is an open-source, asynchronous event-driven network application framework. Rated medium severity (CVSS 5.5), this
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable h
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today