The vulnerability resides in Netty’s SpdyHttpDecoder component, which allocates a pooled ByteBuf while handling a client‑initiated SYN_STREAM frame with the FLAG_FIN value set to zero. The decoder stores this partially constructed HTTP request in an internal map. When the remote peer later sends the RST_STREAM frame for that stream or the accumulated content exceeds the configured maxContentLength, the decoder removes the map entry but fails to release the pooled ByteBuf, causing native memory to be exhausted. This results in a denial‑of‑service condition for the process using the library, potentially bringing down applications that rely on Netty for network communication.

Affected are Netty versions 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final. Applications that employ Netty’s SPDY‑to‑HTTP codec, a protocol conversion layer used in network servers and clients, are therefore at risk.

The CVSS score of 8.7 indicates a high severity. The EPSS score is reported as less than 1%, suggesting that while the exploit exists, it is not widely used or actively exploited. The issue is not listed in CISA’s KEV catalog. Based on the description, it is inferred that a remote attacker can trigger the exploit by sending a crafted SPDY frame sequence—specifically, a SYN_STREAM frame with FLAG_FIN=0 followed by a RST_STREAM frame—to a vulnerable Netty‑based service. If successful, this would exhaust the system’s native memory and render the application unavailable.