Netty is a popular event‑driven network application framework that processes SPDY protocol frames. An error in the SPDY header decoder caused the library to continue inflating zlib‑compressed header blocks even after the raw header parser had exceeded the configured maxHeaderSize and marked the frame as truncated. The continued inflation can transform a small compressed HEADERS block into a much larger raw header payload, leading to excessive CPU usage and memory allocation churn. This flaw is classified as CWE‑400 (Uncontrolled Resource Consumption) and, by inference, also involves resource exhaustion (CWE‑409).

The vulnerability affects the Netty framework provided by the Netty community. Versions prior to 4.1.136.Final and 4.2.16.Final are susceptible. Applications that depend on these versions and that expose SPDY or HTTP/2 endpoints are at risk until an update is applied.

The CVSS score of 7.5 indicates a high risk, while the EPSS score is below 1 percent, suggesting that widespread exploitation is unlikely at present. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is remote: an attacker can initiate a network connection to a vulnerable server exposing SPDY, send a compressed header block that is truncated by length checks, and cause the server to inflate and allocate resources, potentially triggering a denial‑of‑service condition.