CVE-2026-55831
Received Received - Intake

Heap Exhaustion in Netty SPDY Settings Frame

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-55831

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
netty netty to 4.2.16.Final (exc)
netty netty From 4.2.0.Final (inc) to 4.2.16.Final (exc)
netty netty From 4.1.0.Final (inc) to 4.1.136.Final (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Netty's SPDY SETTINGS decoder, which accepts a peer-declared SETTINGS entry count up to a 24-bit frame-length limit. It materializes every unique setting ID in DefaultSpdySettingsFrame, allowing a remote attacker to send a syntactically valid 2 MiB SETTINGS frame with 262,144 map entries. This causes heap growth and CPU overhead due to ordered-map insertion, leading to resource exhaustion and a denial-of-service condition.

Detection Guidance

Monitor for unusual network traffic patterns, particularly large SPDY SETTINGS frames (around 2 MiB) with high entry counts. Check Netty server logs for excessive memory usage or CPU spikes during SPDY/3.1 protocol handling. Use network monitoring tools like Wireshark to inspect SPDY frames for abnormal SETTINGS frame sizes.

Impact Analysis

This vulnerability can impact you by causing significant resource exhaustion on systems using vulnerable Netty versions. It may lead to denial-of-service conditions, where the system becomes unresponsive or crashes due to excessive memory usage and CPU overhead from processing the malicious SETTINGS frame.

Compliance Impact

This vulnerability could lead to denial-of-service conditions due to resource exhaustion, which may impact the availability of systems handling sensitive data. For GDPR, this could affect the right to access or the right to rectification if services become unavailable. For HIPAA, it may disrupt access to protected health information, potentially violating availability requirements.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or later for 4.1.x users, or 4.2.16.Final or later for 4.2.x users. If immediate upgrade is not possible, disable SPDY/3.1 protocol support on affected Netty servers to prevent exploitation. Apply network-level mitigations like rate limiting for SPDY traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55831. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart