Skip to main content

Netty CVE-2026-55833

HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-07-20 GitHub_M GHSA-mvh2-crg5-v77c
Denial Of Service Red Hat Suse Netty
7.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Remote unauthenticated peer sends a compressed frame with low complexity and no interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 20, 2026 - 23:46 vuln.today
Analysis Generated
Jul 20, 2026 - 23:46 vuln.today
CVE Published
Jul 20, 2026 - 23:18 cve.org
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 344 maven packages depend on io.netty:netty-codec-http (32 direct, 312 indirect)

Ecosystem-wide dependent count for version 4.2.0.Final.

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in SpdyFrameCodec, allowing a remote peer to send a small compressed HEADERS block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

AnalysisAI

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.Final) allows a remote peer to send a small zlib-compressed SPDY HEADERS block that Netty keeps inflating even after the raw header parser exceeds maxHeaderSize and marks the frame truncated in SpdyFrameCodec. The result is disproportionate CPU consumption and allocation churn (CWE-400) from a tiny input, degrading or crashing services that expose the SPDY codec. No public exploit identified at time of analysis and it is not listed in CISA KEV; impact is availability-only per CVSS 7.5 (A:H).

Technical ContextAI

The affected component is Netty's SPDY protocol support, specifically SpdyFrameCodec and its zlib-based header block decompression. SPDY (Google's precursor to HTTP/2) compresses HTTP header blocks with a shared zlib/DEFLATE dictionary; Netty enforces a maxHeaderSize limit on the decompressed raw header data. The flaw is that even once the raw header parser passes maxHeaderSize and flags the frame as truncated, the zlib inflater continues to decompress the remaining compressed bytes rather than aborting, so a highly compressible payload expands into far more raw data and work than the size cap should permit. This is a classic decompression-amplification / 'zip bomb' style resource-exhaustion issue mapped to CWE-400 (Uncontrolled Resource Consumption). The CPE cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* confirms the affected product is the Netty library itself rather than a specific downstream application.

RemediationAI

Vendor-released patch: upgrade to Netty 4.1.136.Final (4.1.x branch) or 4.2.16.Final (4.2.x branch), which fix the header decompression to stop inflating once the frame is marked truncated; see the advisory at https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c and the fix commits 5b68c61f37aa4a3045cba624cbea239655c9003b and bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6. Where immediate upgrade is not possible, the most effective compensating control is to stop using Netty's SPDY codec entirely by removing SpdyFrameCodec/SPDY handlers from the pipeline and serving HTTP/2 or HTTP/1.1 instead, since SPDY is deprecated - the trade-off is loss of SPDY protocol support for any legacy clients that still rely on it. If SPDY must remain enabled, place the endpoint behind connection rate-limiting and per-connection CPU/time and memory quotas and restrict network exposure of the SPDY listener to trusted peers, accepting that these controls only reduce, not eliminate, the amplification impact.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2024-36121 CRITICAL POC
9.1 Jun 04

netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
CVE-2024-40642 HIGH POC
8.1 Jul 18

The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
CVE-2022-41881 HIGH POC
7.5 Dec 12

Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
CVE-2020-7238 HIGH POC
7.5 Jan 27

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

CVE-2026-55833 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy