Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Published: 2026-07-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A remote actor can send crafted HTTP/2 DATA frames to a Netty server that has HTTP/2 content decompression turned on. The vulnerable code incorrectly retains a ByteBuf without releasing it when the decompressor is already closed. Each frame consumes a chunk of off‑heap memory and, over time, the application exhausts direct memory, causing the JVM to crash. This manifests as a denial of service that terminates the application process.

Affected Systems

The vulnerability affects Netty library versions 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final when the DelegatingDecompressorFrameListener is used to enable HTTP/2 content decompression. Any application that includes this module and exposes a Netty‑based HTTP/2 endpoint is susceptible. The fix is delivered in Netty 4.1.136.Final and 4.2.16.Final.

Risk and Exploitability

With a CVSS score of 7.5 the issue is considered high severity. The EPSS score of less than 1 % suggests that active exploitation is unlikely at present, and it is not listed in CISA’s KEV catalogue. However, the attack requires only sending crafted HTTP/2 DATA frames; no authentication or privileged access is needed. An attacker could trigger the memory leak, leading to a full application crash and service interruption.

Generated by OpenCVE AI on August 2, 2026 at 18:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Netty library to 4.1.136.Final or later, or to 4.2.16.Final or later, which contain the fix that releases the ByteBuf on error.
  • If an upgrade cannot be performed immediately, disable HTTP/2 content decompression in the application by removing the DelegatingDecompressorFrameListener configuration.
  • Monitor the JVM’s off‑heap memory usage and watch for sudden spikes or out‑of-memory errors; configure alerts to catch potential denial‑of-service attempts early.

Generated by OpenCVE AI on August 2, 2026 at 18:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-93wv-jw9v-4972 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
History

Tue, 28 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-911
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 23 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 16:00:00 +0000

Type Values Removed Values Added
References

Wed, 22 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
First Time appeared Netty
Netty netty
Vendors & Products Netty
Netty netty

Tue, 21 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Description Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Title Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Weaknesses CWE-400
CWE-401
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Netty Netty
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-23T13:55:29.793Z

Reserved: 2026-06-23T14:55:09.116Z

Link: CVE-2026-56819

cve-icon Vulnrichment

Updated: 2026-07-23T13:55:08.467Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-21T22:11:17Z

Links: CVE-2026-56819 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T18:45:17Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-401

    Missing Release of Memory after Effective Lifetime

  • CWE-911

    Improper Update of Reference Count