A failure to enforce the maxAllocation parameter in Netty’s HttpContentDecompressor allows an attacker to supply a deeply compressed payload that bypasses the memory limit when the Content‑Encoding header is set to brotli, zstd, or snappy. The decompressor then allocates an unbounded amount of memory, potentially exhausting system resources and causing an out‑of‑memory denial of service. This weakness is identified as CWE‑400 and CWE‑770, the former being a generic resource‑exhaustion flaw and the latter indicating an insufficient system capability to handle the resource demands.

The vulnerability affects Netty components io.netty:netty-codec-http, io.netty:netty-codec-http2, and the core netty library. All releases before 4.2.13.Final and 4.1.133.Final are susceptible, including earlier 4.x and 4.1.x versions. HTTP/2 connections through DelegatingDecompressorFrameListener are also impacted.

The CVSS score of 7.5 indicates substantial severity. The EPSS score of 0.00018 (≈0.018 %) indicates a very low but non‑zero probability of exploitation, consistent with the fact that the flaw requires a specially crafted HTTP request. The vulnerability is not listed in CISA’s KEV catalog, yet it can be triggered wherever Netty is used to decode compressed HTTP traffic. The likely attack vector is an HTTP request containing a maliciously compressed payload with a Content‑Encoding header set to br, zstd, or snappy, causing the server to allocate memory beyond the configured limit.