A remote attacker can cause a denial of service on a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server lacks a limit on the number of these frames and a bypass around size restrictions allows zero‑byte frames to be used, resulting in excessive CPU consumption while using minimal bandwidth.

The vulnerability affects Netty, distributed under the netty:netty package. Versions prior to 4.1.132.Final in the 4.1 series and prior to 4.2.10.Final in the 4.2 series are susceptible. Updating to these versions or later removes the flaw.

The CVSS score is 8.7, indicating high severity. No EPSS score is listed and the vulnerability is not a known exploited vulnerability in CISA's KEV catalog. Because the attack can be launched remotely over HTTP/2 by simply sending too many CONTINUATION frames, the risk is high and exploitation is straightforward if the server remains unpatched.