Netty up to 4.2.15.Final/4.1.135.Final Decompression Http2Decompressor.decompress data resource consumption

Summaryinfo

A vulnerability labeled as problematic has been found in Netty up to 4.2.15.Final/4.1.135.Final. This impacts the function Http2Decompressor.decompress of the component Decompression. Such manipulation of the argument data leads to resource consumption. This vulnerability is listed as CVE-2026-56819. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Netty up to 4.2.15.Final/4.1.135.Final and classified as problematic. Affected by this issue is the function Http2Decompressor.decompress of the component Decompression. The manipulation of the argument data with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-56819 since 06/23/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 4.1.136.Final or 4.2.16.Final eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Netty

Version

• 4.1.135.Final
• 4.2.15.Final

Website

• Product: https://github.com/netty/netty/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion