CVE-2026-56819
Summary
by MITRE • 07/22/2026
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability affects the Netty networking framework's implementation of HTTP/2 protocol handling with content decompression capabilities. The flaw exists in specific versions of Netty where applications utilizing `DelegatingDecompressorFrameListener` for HTTP/2 content decompression are susceptible to direct memory exhaustion attacks. When processing HTTP/2 DATA frames, a remote unauthenticated peer can trigger a memory leak condition that results in one direct ByteBuf being leaked per frame processed.
The technical mechanism of this vulnerability involves the `Http2Decompressor.decompress(...)` method which calls `decompressor.writeInbound(data.retain())` when handling DATA frames for streams with already closed decompressors. The critical issue occurs on the error path where the retained buffer is not properly released, creating a memory leak condition that accumulates over time. This behavior directly violates CWE-401: Improper Release of Memory and represents a classic case of resource leak in network protocol handling code.
The operational impact of this vulnerability manifests as progressive direct memory exhaustion, ultimately leading to JVM crashes and application downtime. Attackers can exploit this by sending specially crafted HTTP/2 DATA frames to trigger the memory leak condition, causing the system to consume increasing amounts of direct memory until the JVM terminates. This creates a denial-of-service scenario that affects any application using vulnerable Netty versions with HTTP/2 decompression enabled.
The vulnerability aligns with ATT&CK technique T1499.004: Endpoint Denial of Service through resource exhaustion attacks and demonstrates how protocol handling flaws can be exploited to cause system instability. Organizations running web servers, proxies, or any HTTP/2 enabled applications using affected Netty versions are at risk. The fix implemented in versions 4.1.136.Final and 4.2.16.Final addresses the specific memory release issue by ensuring proper buffer cleanup on error paths.
Security practitioners should prioritize upgrading affected systems to the patched versions immediately, as this vulnerability can be exploited remotely without authentication. Additionally, monitoring for direct memory usage patterns and implementing rate limiting for HTTP/2 connections can provide additional defense-in-depth measures while awaiting patches. The vulnerability highlights the importance of proper resource management in high-performance networking frameworks where protocol handling code paths must account for all potential error conditions and resource cleanup scenarios.