SPDY SETTINGS Decoder Vulnerability in Netty Framework
CVE-2026-55831
What is CVE-2026-55831?
The Netty Framework, known for its role in developing protocol servers and clients, has a vulnerability in its SPDY SETTINGS decoder prior to versions 4.1.136.Final and 4.2.16.Final. This issue allows a remote peer employing SPDY/3.1 to exploit the system by sending a syntactically valid SETTINGS frame that can lead to excessive heap growth and performance degradation due to the creation of 262,144 map entries. This behavior arises from the decoder's acceptance of a peer-declared SETTINGS entry count, exceeding standard frame-length limits, which amplifies the network input. It's crucial for users of affected versions to upgrade to the latest releases to mitigate potential risks associated with this vulnerability.
Affected Version(s)
netty >= 4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final
netty >= 4.1.0.Final, < 4.1.136.Final < 4.1.0.Final, 4.1.136.Final