Netty
CVE-2026-55833
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated peer sends a compressed frame with low complexity and no interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded maxHeaderSize and marked the frame truncated in SpdyFrameCodec, allowing a remote peer to send a small compressed HEADERS block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
AnalysisAI
Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.Final) allows a remote peer to send a small zlib-compressed SPDY HEADERS block that Netty keeps inflating even after the raw header parser exceeds maxHeaderSize and marks the frame truncated in SpdyFrameCodec. The result is disproportionate CPU consumption and allocation churn (CWE-400) from a tiny input, degrading or crashing services that expose the SPDY codec. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must have Netty's SPDY support active - specifically SpdyFrameCodec / the SPDY handlers configured in the channel pipeline and accepting SPDY connections from remote peers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a remote, unauthenticated peer with low complexity and no user interaction can trigger the condition, and impact is confined to availability with no confidentiality or integrity effect - appropriate for a DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker connects to an internet-facing service that has Netty's SPDY codec enabled and sends a single small, highly compressible zlib HEADERS block crafted to expand well beyond maxHeaderSize. Because the decoder keeps inflating after the truncation limit is hit, each cheap request forces expensive decompression and large allocations on the server; repeating this across connections exhausts CPU and heap and denies service to legitimate users. … |
| Remediation | Vendor-released patch: upgrade to Netty 4.1.136.Final (4.1.x branch) or 4.2.16.Final (4.2.x branch), which fix the header decompression to stop inflating once the frame is marked truncated; see the advisory at https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c and the fix commits 5b68c61f37aa4a3045cba624cbea239655c9003b and bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Netty versions prior to 4.1.136.Final (4.1.x branch) or 4.2.16.Final (4.2.x branch) and verify whether SPDY protocol is enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan
Netty project is an event-driven asynchronous network application framework. Rated medium severity (CVSS 6.5), this vuln
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan
Netty is an open-source, asynchronous event-driven network application framework. Rated medium severity (CVSS 5.5), this
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable h
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today