Memory Exhaustion Vulnerability in Netty Framework
CVE-2026-56745
What is CVE-2026-56745?
The Netty framework, employed for developing protocol servers and clients, has a memory exhaustion vulnerability originating from the SpdyHttpDecoder handler in its SPDY-to-HTTP codec. When processing a client-initiated SYN_STREAM frame with the FLAG_FIN=0, a pooled ByteBuf is allocated and stored in the messageMap. If the remote peer sends an RST_STREAM for the stream or if the accumulated content surpasses the maxContentLength, the decoder removes the entry but fails to release the pooled ByteBuf. This oversight results in a potential for native memory exhaustion. The vulnerability has been resolved in versions 4.1.136.Final and 4.2.16.Final.
Affected Version(s)
netty >= 4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final
netty >= 4.1.0.Final, < 4.1.136.Final < 4.1.0.Final, 4.1.136.Final