Skip to main content

Netty EUVDEUVD-2026-47581

| CVE-2026-56819 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-07-21 security-advisories@github.com GHSA-93wv-jw9v-4972
Denial Of Service Red Hat Netty
7.5
CVSS 3.1 · Vendor: github
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Open HTTP/2 connection to Netty service
  2. Delivery
    Send compressed DATA frames on closed-decompressor stream
  3. Exploit
    Retained direct ByteBuf leaks per frame
  4. Execution
    Repeat to exhaust direct memory
  5. Impact
    JVM OutOfDirectMemory crash and DoS

Vulnerability Assessment

Weakness
CWE
CWE-400
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the target application to have HTTP/2 content decompression explicitly enabled via Netty's DelegatingDecompressorFrameListener - this is the exact, non-default configuration prerequisite; standard HTTP/2 handling without that listener is not affected. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed, and the attack is remote against any reachable HTTP/2 endpoint. The primary limiting factor is therefore configuration-dependence (the decompression listener must be installed) plus the requirement that DATA frames be delivered to a stream whose decompressor is already closed; affected versions are 4.2.0-4.2.15.Final and 4.1.0-4.1.135.Final.
Impact

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, High) reflects a network-reachable, low-complexity, unauthenticated availability-only impact - no confidentiality or integrity loss, purely a crash/DoS, consistent with the vendor's 'Denial Of Service' tag. The practical risk is gated by a non-default prerequisite: the target application must have enabled HTTP/2 content decompression via DelegatingDecompressorFrameListener, which many deployments do not configure, so the AC:L rating understates the real-world setup dependency. No EPSS score was supplied to gauge exploitation likelihood, there is no KEV listing, and no POC was referenced - signals point to a real but conditional availability risk rather than a mass-exploited critical. Weigh this as a priority for services that both terminate HTTP/2 and use Netty's built-in decompression listener; for everyone else it is lower urgency.
Exploit ScenarioDerived

An attacker opens an HTTP/2 connection to a public-facing service that uses Netty's DelegatingDecompressorFrameListener, then repeatedly sends compressed DATA frames on streams timed so the decompressor is already closed, causing each frame to leak a direct ByteBuf. Sustained over a short burst, off-heap memory is exhausted and the JVM crashes, taking the service offline; no authentication or user interaction is required, and given AV:N/AC:L the requests can be fully automated. No public POC was referenced at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Denial of service in the Netty network framework (4.2.0.Final-4.2.15.Final and 4.1.0.Final-4.1.135.Final) lets a remote unauthenticated peer exhaust JVM direct memory and crash the process. Applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener leak one direct ByteBuf for every HTTP/2 DATA frame delivered to a stream whose decompressor has already been closed, because Http2Decompressor.decompress(...) retains the buffer for writeInbound but never releases it on the error path. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

RemediationAI

Upgrade Netty to a fixed release - Vendor-released patch: 4.1.136.Final for the 4.1 branch or 4.2.16.Final for the 4.2 branch (release notes at https://github.com/netty/netty/releases/tag/netty-4.1.136.Final and https://github.com/netty/netty/releases/tag/netty-4.2.16.Final; advisory GHSA-93wv-jw9v-4972). Because Netty is usually a transitive dependency, pin or override the version in your build (Maven/Gradle dependency management) so frameworks pull the patched artifact. If immediate patching is not possible, the most direct compensating control is to disable HTTP/2 content decompression by not installing DelegatingDecompressorFrameListener - the side effect is that clients must send uncompressed bodies or your application must decompress at a higher layer, increasing bandwidth/CPU cost. As additional interim measures, front the service with a proxy or WAF that strips content-encoding on HTTP/2 request bodies, and set/monitor -XX:MaxDirectMemorySize with alerting so a leak degrades gracefully rather than crashing silently; none of these fully close the leak, so treat them as stopgaps until the upgrade lands.

Affected VersionsENISA

netty 4.2.0.Final, < 4.2.16.Final
netty 4.1.0.Final, < 4.1.136.Final

Affected Packages

maven io.netty:netty-codec-http2 fix: 4.1.136.Final, 4.2.16.Final
euvd netty_4_1_0_final fix: 4.1.136.Final
euvd netty_4_2_0_final fix: 4.2.16.Final

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in Netty's HTTP/2 codec, specifically Http2Decompressor and the DelegatingDecompressorFrameListener that transparently inflates gzip/deflate-encoded HTTP/2 DATA payloads. Netty manages payloads as reference-counted direct (off-heap) ByteBuf objects that must be explicitly released. When a DATA frame arrives for a stream whose decompressor has already been closed, decompress(...) calls decompressor.writeInbound(data.retain()) - incrementing the buffer's reference count - but the closed-decompressor/error path returns without releasing that retained buffer, so the off-heap allocation is never reclaimed. This is a classic CWE-400 (Uncontrolled Resource Consumption) memory/reference leak: each malicious or mistimed frame permanently pins a chunk of direct memory until the pool is exhausted and the JVM throws OutOfDirectMemoryError and dies.

Know when Netty gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (github) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 7.5 HIGH

Remote unauthenticated peer triggers a direct-memory leak with no user interaction; impact is availability-only (JVM crash), so C:N/I:N/A:H, matching the published 7.5.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 31, 2026 - 18:32 EUVD
CVE Published
Jul 21, 2026 - 23:17 cve.org
HIGH 7.5

DescriptionCVE.org

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed, Http2Decompressor.decompress(...) calls decompressor.writeInbound(data.retain()) and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Executive ViewAI

Why It Matters

Netty framework versions 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final contain a denial-of-service vulnerability in HTTP/2 content decompression accessible to unauthenticated remote attackers, who can exhaust JVM direct memory and crash applications. No public exploit identified at time of analysis. Organizations relying on these versions with HTTP/2 enabled face potential application downtime, and the absence of released patches requires immediate operational or architectural mitigations.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: disable HTTP/2 content decompression or the HTTP/2 protocol entirely if not critical to operations; implement rate limiting and connection-level controls on HTTP/2 DATA frames; monitor JVM direct memory utilization on affected processes with aggressive alerting thresholds; restrict network access to Netty applications to known, trusted clients; evaluate alternative Java HTTP/2 implementations if decompression is operationally essential.

Threat Intelligence Overview

EPSS Score
0.6%
Top 54% exploitable
Prevalence
High
Netty underpies a huge share of Java server, proxy, and gRPC stacks
Threat Intel
1
1 sources
Exploit
POC
Public exploit code exists
Social Media
2
Sightings
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.6%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

59
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Netty

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2019-16869 HIGH POC
7.5 Sep 26

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked
CVE-2026-56820 CRITICAL POC
9.1 Jul 21

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affec
CVE-2024-36121 CRITICAL POC
9.1 Jun 04

netty-incubator-codec-ohttp is the OHTTP implementation for netty. Rated critical severity (CVSS 9.1), this vulnerabilit
CVE-2024-40642 HIGH POC
8.1 Jul 18

The netty incubator codec.bhttp is a java language binary http parser. Rated high severity (CVSS 8.1), this vulnerabilit
CVE-2025-24970 HIGH POC
7.5 Feb 10

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final
CVE-2026-59902 HIGH POC
7.5 Aug 17

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to

CVE-2026-55833 HIGH POC
7.5 Jul 20

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.F
CVE-2026-55831 HIGH POC
7.5 Jul 20

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16
CVE-2026-56816 HIGH POC
7.5 Jul 21

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final
CVE-2026-59903 HIGH POC
7.5 Aug 17

Netty's HTTP CORS handler silently rewrites the Vary response header to Vary: Origin in releases before 4.1.137.Final an
CVE-2026-48748 HIGH POC
7.5 Jun 12

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote una

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2021-21341 HIGH POC
7.5
CVE-2022-29885 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:47172 ADVISORY https://access.redhat.com/errata/RHSA-2026:47189 ADVISORY https://access.redhat.com/errata/RHSA-2026:48118 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-56819 ADVISORY https://vuldb.com/vuln/382028 REF https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b REF https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final REF https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 REF https://github.com/netty/netty/releases/tag/netty-4.1.136.Final REF https://github.com/netty/netty/releases/tag/netty-4.2.16.Final REF https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy