Remote Memory Leak in Netty HTTP/2 Compression Handling
CVE-2026-56819
7.5HIGH
What is CVE-2026-56819?
A vulnerability exists in specific versions of the Netty framework due to improper handling of HTTP/2 content decompression. This flaw allows a remote unauthenticated peer to potentially leak direct ByteBuf instances with each DATA frame processed. If the decompressor for a stream has already been closed, it leads to a situation where the retained buffer is not released, which can eventually exhaust the JVM's direct memory allocation, causing system crashes. The issue has been addressed in updates to versions 4.1.136.Final and 4.2.16.Final.
Affected Version(s)
netty >= 4.2.0.Final, < 4.2.16.Final < 4.2.0.Final, 4.2.16.Final
netty >= 4.1.0.Final, < 4.1.136.Final < 4.1.0.Final, 4.1.136.Final