Skip to main content

Netty CVE-2026-56819

| EUVDEUVD-2026-47581 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-07-21 security-advisories@github.com GHSA-93wv-jw9v-4972
Denial Of Service Netty Red Hat
7.5
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Remote unauthenticated peer triggers a direct-memory leak with no user interaction; impact is availability-only (JVM crash), so C:N/I:N/A:H, matching the published 7.5.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch available
Jul 31, 2026 - 18:32 EUVD
Source Code Evidence Fetched
Jul 22, 2026 - 00:32 vuln.today
Analysis Generated
Jul 22, 2026 - 00:32 vuln.today
CVE Published
Jul 21, 2026 - 23:17 cve.org
HIGH 7.5

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed, Http2Decompressor.decompress(...) calls decompressor.writeInbound(data.retain()) and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

AnalysisAI

Denial of service in the Netty network framework (4.2.0.Final-4.2.15.Final and 4.1.0.Final-4.1.135.Final) lets a remote unauthenticated peer exhaust JVM direct memory and crash the process. Applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener leak one direct ByteBuf for every HTTP/2 DATA frame delivered to a stream whose decompressor has already been closed, because Http2Decompressor.decompress(...) retains the buffer for writeInbound but never releases it on the error path. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The flaw lives in Netty's HTTP/2 codec, specifically Http2Decompressor and the DelegatingDecompressorFrameListener that transparently inflates gzip/deflate-encoded HTTP/2 DATA payloads. Netty manages payloads as reference-counted direct (off-heap) ByteBuf objects that must be explicitly released. When a DATA frame arrives for a stream whose decompressor has already been closed, decompress(...) calls decompressor.writeInbound(data.retain()) - incrementing the buffer's reference count - but the closed-decompressor/error path returns without releasing that retained buffer, so the off-heap allocation is never reclaimed. This is a classic CWE-400 (Uncontrolled Resource Consumption) memory/reference leak: each malicious or mistimed frame permanently pins a chunk of direct memory until the pool is exhausted and the JVM throws OutOfDirectMemoryError and dies.

RemediationAI

Upgrade Netty to a fixed release - Vendor-released patch: 4.1.136.Final for the 4.1 branch or 4.2.16.Final for the 4.2 branch (release notes at https://github.com/netty/netty/releases/tag/netty-4.1.136.Final and https://github.com/netty/netty/releases/tag/netty-4.2.16.Final; advisory GHSA-93wv-jw9v-4972). Because Netty is usually a transitive dependency, pin or override the version in your build (Maven/Gradle dependency management) so frameworks pull the patched artifact. If immediate patching is not possible, the most direct compensating control is to disable HTTP/2 content decompression by not installing DelegatingDecompressorFrameListener - the side effect is that clients must send uncompressed bodies or your application must decompress at a higher layer, increasing bandwidth/CPU cost. As additional interim measures, front the service with a proxy or WAF that strips content-encoding on HTTP/2 request bodies, and set/monitor -XX:MaxDirectMemorySize with alerting so a leak degrades gracefully rather than crashing silently; none of these fully close the leak, so treat them as stopgaps until the upgrade lands.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
CVE-2022-41881 HIGH POC
7.5 Dec 12

Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
CVE-2020-7238 HIGH POC
7.5 Jan 27

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

CVE-2026-56819 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy