CVE-2026-56745 in Netty
Summary
by MITRE • 07/22/2026
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability described affects Netty's SPDY-to-HTTP codec implementation where a memory management flaw exists within the `SpdyHttpDecoder` handler. This issue specifically manifests when processing client-initiated `SYN_STREAM` frames with `FLAG_FIN=0`, which indicates that the stream is not yet complete and additional data will follow. The decoder allocates a pooled `ByteBuf` to handle the incoming data but fails to properly release this memory resource under specific conditions, leading to progressive native memory exhaustion.
The technical flaw resides in the improper handling of pooled memory resources within the SPDY protocol implementation. When a `SYN_STREAM` frame is received with `FLAG_FIN=0`, the decoder creates and stores a partially constructed `FullHttpRequest` in a `messageMap` data structure. The pool allocation occurs as part of normal processing, but the cleanup logic becomes problematic when either a `RST_STREAM` frame is received from the remote peer or when accumulated content exceeds the configured `maxContentLength` threshold. In both scenarios, the decoder correctly removes the entry from `messageMap` but neglects to invoke the appropriate release mechanism for the associated pooled `ByteBuf`.
This memory leak represents a classic case of resource management failure that can be classified under CWE-404, which deals with improper resource cleanup or release. The vulnerability falls within the ATT&CK framework's T1499.004 technique related to network denial of service through resource exhaustion attacks. The impact is particularly severe because pooled `ByteBuf` objects in Netty are backed by native memory, making this issue a direct threat to system stability and availability.
The operational impact extends beyond simple memory consumption as the progressive nature of the leak can eventually cause application crashes or complete system unresponsiveness. Attackers could potentially exploit this vulnerability by establishing multiple connections with streams that remain open long enough for significant data accumulation, then triggering `RST_STREAM` frames to force the problematic code path. This scenario would allow for sustained memory consumption that could exhaust available native resources and cause service disruption.
Mitigation strategies should focus on immediate patching to versions 4.1.136.Final or 4.2.16.Final where the fix has been implemented. Organizations should also implement monitoring for native memory usage patterns in applications using Netty's SPDY codec, particularly when handling high-volume or long-lived connections. Additional defensive measures include configuring appropriate `maxContentLength` values to limit resource consumption and implementing connection limiting mechanisms to prevent exploitation through massive concurrent connections. The fix ensures that pooled `ByteBuf` resources are properly released regardless of the stream termination condition, thereby preventing the native memory exhaustion scenario described in the vulnerability report.