Skip to main content

Netty EUVDEUVD-2026-47564

| CVE-2026-56816 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-07-21 security-advisories@github.com GHSA-hpcc-26xq-25fv
Denial Of Service Red Hat Netty
7.5
CVSS 3.1 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach QUIC/HTTP-3 listener
  2. Delivery
    Open multiple QUIC streams
  3. Exploit
    Send reserved frames with huge payLoadLength
  4. Execution
    decodeFrame buffers unbounded payloads
  5. Persist
    Heap memory exhausted
  6. Impact
    Server crash / denial of service

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target must be running Netty prior to 4.2.16.Final AND actively using the HTTP/3 codec (Http3FrameCodec) over a QUIC listener reachable by the attacker - this is the concrete prerequisite, since applications using only HTTP/1.1 or HTTP/2 do not expose the vulnerable decodeFrame path. Given AV:N/AC:L/PR:N/UI:N, once HTTP/3 is exposed there are no further gates: no authentication, no user interaction, and default configuration is sufficient. The attacker needs the ability to open multiple QUIC streams and craft reserved-type frames with oversized payLoadLength values, which requires a QUIC/HTTP-3-capable client but no special privileges. The main limiting factor is that HTTP/3 support is an optional, opt-in Netty module, so the realistic attack surface is narrower than the raw 7.5 network score implies.
Impact

The signals are internally consistent but modest: CVSS 3.1 is 7.5 driven entirely by availability impact (C:N/I:N/A:H) with a fully remote, low-complexity, unauthenticated, no-interaction vector (AV:N/AC:L/PR:N/UI:N), which fits a network-reachable resource-exhaustion bug. There is no confidentiality or integrity impact and no code execution, so this is a service-availability issue rather than a compromise vector. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - the risk is real but DoS-only and, critically, gated on the target actually running the optional HTTP/3 codec. Treat this as a prompt-patch item for internet-facing QUIC/HTTP-3 endpoints rather than an emergency; the high CVSS reflects easy reachability, not severity of outcome. Note also that the supplied source-code diff does not match the described HTTP/3 flaw (see confidence notes), which adds uncertainty about the exact patched code path.
Exploit ScenarioDerived

An attacker points a QUIC/HTTP-3 client at an internet-facing service running Netty's HTTP/3 codec, opens many QUIC streams, and on each sends a reserved-type HTTP/3 frame whose header declares an enormous payload length. The server allocates buffers to match each declared length, and with low attack complexity and no authentication the aggregate allocation exhausts heap memory and forces an out-of-memory crash. No public POC was identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final, where decodeFrame trusts the wire-supplied payLoadLength and buffers reserved-frame-type payloads without an upper bound. A remote unauthenticated attacker (CVSS 7.5, AV:N/PR:N) can open many QUIC streams and advertise very large payload lengths on reserved HTTP/3 frames to force unbounded heap allocation and crash the server. No public exploit or CISA KEV listing exists at time of analysis; a vendor patch (4.2.16.Final) is available.

RemediationAI

Upgrade to Netty 4.2.16.Final, which bounds buffered reserved-frame payloads; this is the primary, vendor-confirmed fix (Vendor-released patch: 4.2.16.Final, per GHSA-hpcc-26xq-25fv and the 4.2.16.Final release notes). Because Netty is usually a transitive dependency, update the version pin in your Maven/Gradle build and rebuild rather than waiting on the application vendor. If you cannot upgrade immediately, reduce exposure by disabling or not deploying the HTTP/3 codec and serving traffic over HTTP/2 or HTTP/1.1 instead (trade-off: loss of HTTP/3/QUIC performance benefits), and by enforcing per-connection and per-stream memory limits, connection rate limiting, and concurrent-stream caps in front of the QUIC listener (trade-off: aggressive limits may throttle legitimate high-concurrency clients). Monitor JVM heap usage and QUIC stream counts to detect exhaustion attempts. See https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv for advisory details.

Affected VersionsENISA

netty < 4.2.16.Final

Affected Packages

maven io.netty:netty-codec-http3 fix: 4.2.16.Final
euvd netty fix: 4.2.16.Final

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Netty is a widely-used asynchronous, event-driven network application framework for the JVM, and the affected component is its HTTP/3 support layer, which sits on top of Netty's QUIC transport. HTTP/3 multiplexes frames over independent QUIC streams, and each frame is length-prefixed on the wire. The root cause is CWE-400 (Uncontrolled Resource Consumption): Http3FrameCodec.decodeFrame reads the attacker-controlled payLoadLength field for reserved (unknown/grease) frame types and accumulates incoming bytes into a buffer up to that declared length with no maximum-size guard. Because reserved frame types are meant to be ignored, the codec still reserves buffer capacity to reach the advertised length before discarding, so a small number of packets can pin large allocations. Per the EUVD entry (EUVD-2026-47564) and GHSA-hpcc-26xq-25fv, every release below 4.2.16.Final is affected.

Know when Netty gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Remote unauthenticated attacker triggers unbounded memory allocation over QUIC with no interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 21, 2026 - 23:36 EUVD
CVE Published
Jul 21, 2026 - 22:17 cve.org
HIGH 7.5

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; decodeFrame trusts payLoadLength, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 492 maven packages depend on io.netty:netty-codec-http3 (14 direct, 478 indirect)

Ecosystem-wide dependent count for version 4.2.16.Final.

Executive ViewAI

Why It Matters

Netty HTTP/3 codec versions prior to 4.2.16.Final contain a denial-of-service vulnerability allowing unauthenticated remote attackers to crash services through unbounded memory exhaustion. Any organization whose Java applications depend on Netty faces immediate risk to service availability and uptime. A vendor-released patch is available and must be deployed urgently to all affected systems.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.6%
Top 55% exploitable
Prevalence
Medium
Netty is ubiquitous but the vulnerable HTTP/3 codec is an optional, less-deployed module
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2024-36121 CRITICAL POC
9.1 Jun 04

netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
CVE-2024-40642 HIGH POC
8.1 Jul 18

The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-59903 HIGH POC
7.5 Aug 17

Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final an
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una
CVE-2026-50011 HIGH POC
7.5 Jun 12

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remot

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/381515 REF https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b REF https://github.com/netty/netty/releases/tag/netty-4.2.16.Final REF https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy