Skip to main content

Netty EUVDEUVD-2026-47564

| CVE-2026-56816 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-07-21 security-advisories@github.com GHSA-hpcc-26xq-25fv
Denial Of Service Netty
7.5
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Remote unauthenticated attacker triggers unbounded memory allocation over QUIC with no interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Source Code Evidence Fetched
Jul 22, 2026 - 02:31 vuln.today
Analysis Generated
Jul 22, 2026 - 02:31 vuln.today
Patch available
Jul 21, 2026 - 23:36 EUVD
CVE Published
Jul 21, 2026 - 22:17 cve.org
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 564 maven packages depend on io.netty:netty-codec-http3 (12 direct, 552 indirect)

Ecosystem-wide dependent count for version 4.2.16.Final.

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; decodeFrame trusts payLoadLength, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

AnalysisAI

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final, where decodeFrame trusts the wire-supplied payLoadLength and buffers reserved-frame-type payloads without an upper bound. A remote unauthenticated attacker (CVSS 7.5, AV:N/PR:N) can open many QUIC streams and advertise very large payload lengths on reserved HTTP/3 frames to force unbounded heap allocation and crash the server. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach QUIC/HTTP-3 listener
Delivery
Open multiple QUIC streams
Exploit
Send reserved frames with huge payLoadLength
Execution
decodeFrame buffers unbounded payloads
Persist
Heap memory exhausted
Impact
Server crash / denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target must be running Netty prior to 4.2.16.Final AND actively using the HTTP/3 codec (Http3FrameCodec) over a QUIC listener reachable by the attacker - this is the concrete prerequisite, since applications using only HTTP/1.1 or HTTP/2 do not expose the vulnerable decodeFrame path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are internally consistent but modest: CVSS 3.1 is 7.5 driven entirely by availability impact (C:N/I:N/A:H) with a fully remote, low-complexity, unauthenticated, no-interaction vector (AV:N/AC:L/PR:N/UI:N), which fits a network-reachable resource-exhaustion bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker points a QUIC/HTTP-3 client at an internet-facing service running Netty's HTTP/3 codec, opens many QUIC streams, and on each sends a reserved-type HTTP/3 frame whose header declares an enormous payload length. The server allocates buffers to match each declared length, and with low attack complexity and no authentication the aggregate allocation exhausts heap memory and forces an out-of-memory crash. …
Remediation Upgrade to Netty 4.2.16.Final, which bounds buffered reserved-frame payloads; this is the primary, vendor-confirmed fix (Vendor-released patch: 4.2.16.Final, per GHSA-hpcc-26xq-25fv and the 4.2.16.Final release notes). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Audit production inventory to identify all Java applications and services using Netty; query dependency management systems to locate any versions prior to 4.2.16.Final with HTTP/3 codec enabled and escalate as critical remediation priorities. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot
CVE-2022-41881 HIGH POC
7.5 Dec 12

Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulner
CVE-2020-7238 HIGH POC
7.5 Jan 27

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Tr
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
CVE-2025-58057 MEDIUM POC
6.9 Sep 04

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performan

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

Share

EUVD-2026-47564 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy