SPDY Header Decoding Vulnerability in Netty Framework
CVE-2026-55833
What is CVE-2026-55833?
The Netty framework, used for developing network protocol servers and clients, has a vulnerability in its SPDY header decoding process. Prior to versions 4.1.136.Final and 4.2.16.Final, the framework improperly handles zlib-compressed header blocks, leading to excessive resource consumption. Specifically, even after the parser reaches the defined maximum header size and indicates a truncated frame, the decoding process continues, enabling a remote attacker to craft a small compressed 'HEADERS' block. This malicious input can expand significantly, causing CPU and memory allocation overheads. Upgrading to the latest versions is crucial to mitigate this vulnerability.
Affected Version(s)
netty >= 4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final
netty >= 4.1.0.Final, < 4.1.136.Final < 4.1.0.Final, 4.1.136.Final