CVE-2026-55833
Received Received - Intake

Netty SPDY Header Decoding zlib Compression Amplification

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-55833

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
netty netty to 4.2.16.Final (exc)
netty netty From 4.1.136.Final (inc)
netty netty From 4.2.16.Final (inc)
netty netty From 4.1.0.Final (inc) to 4.1.136.Final (exc)
netty netty From 4.2.0.Final (inc) to 4.2.16.Final (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Netty involves improper handling of zlib-compressed SPDY header blocks. When a remote attacker sends a small compressed HEADERS block, it expands into much larger raw header data after the parser exceeds the maxHeaderSize limit. This causes excessive CPU and memory usage, leading to a denial of service.

Detection Guidance

Detect this vulnerability by checking the Netty version in use. If your system runs Netty versions between 4.1.0.Final to 4.1.135.Final or 4.2.0.Final to 4.2.15.Final, it is vulnerable. Use commands like 'find / -name "netty*.jar" -exec jar tf {} \; 2>/dev/null | grep -i "SpdyFrameCodec"' to locate Netty JARs and inspect versions.

Impact Analysis

The vulnerability can cause system slowdowns or crashes due to high CPU and memory consumption. It requires a reachable SPDY codec in the Netty pipeline and no prior size or rate limits. Attackers can exploit it remotely without authentication.

Compliance Impact

This vulnerability primarily causes denial-of-service through CPU and memory exhaustion, which could impact system availability. While not directly violating GDPR or HIPAA, such resource exhaustion could lead to service disruptions affecting data processing or access, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade Netty to versions 4.1.136.Final or 4.2.16.Final or later. If upgrading is not immediately possible, disable SPDY codec in the Netty pipeline or implement network-level rate limiting to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55833. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart