Netty’s HTTP/2 codec used a delegating decompressor that created a per‑stream EmbeddedChannel. Decompressed data were pooled ByteBuf objects that the tail handler owned and had to release. If a remote peer sent frames that triggered a flow‑controller exception, the delegate would fail to release the buffer, resulting in a reference‑count leak. Over time, the leak can exhaust JVM heap and cause an out‑of‑memory error, terminating the process and making the service unavailable. The flaw is an uncontrolled resource consumption weakness (CWE‑400), an improper buffer management problem (CWE‑401), and a missing release of resources (CWE‑772).

All releases of Netty that embed netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final are affected. Any application that incorporates Netty 4.1.x or 4.2.x for HTTP/2 handling is at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is below 1 % and the issue is not listed in CISA’s KEV catalog, suggesting a low likelihood of active exploitation. The attack vector is a remote attacker who can send crafted HTTP/2 frames to a Netty server; only service availability is compromised, with no reported confidentiality or integrity impact. While exploitation is considered unlikely, detection through memory usage and log monitoring can help identify attempts.