CVE-2026-56745

Analyzed Analyzed - Analysis Complete

Memory Leak in Netty SPDY-to-HTTP Codec

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-56745

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	From 4.1.0 (inc) to 4.1.136 (exc)
netty	netty	From 4.2.0 (inc) to 4.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final involves a memory leak in the SPDY-to-HTTP codec. When processing a client-initiated SYN_STREAM frame with FLAG_FIN=0, the SpdyHttpDecoder allocates a pooled ByteBuf and stores a partially constructed FullHttpRequest. If the remote peer sends RST_STREAM or content exceeds maxContentLength, the decoder removes the entry but fails to release the pooled ByteBuf, leading to native memory exhaustion.

Detection Guidance

This vulnerability involves memory exhaustion due to un-released pooled ByteBuf objects in Netty's SPDY-to-HTTP codec. Detection requires checking for memory leaks in Netty applications handling SPDY traffic, particularly when processing SYN_STREAM frames with FLAG_FIN=0 followed by RST_STREAM or exceeding maxContentLength. Monitor system memory usage and Netty's direct memory pool for abnormal growth.

Impact Analysis

This vulnerability can cause native memory exhaustion on systems using affected Netty versions. This may lead to application crashes, degraded performance, or denial of service due to resource depletion. Systems processing high volumes of SPDY traffic are particularly at risk.

Compliance Impact

This vulnerability causes native memory exhaustion due to un-released pooled ByteBuf objects in Netty's SPDY-to-HTTP codec. While not directly tied to data protection, memory exhaustion could lead to service disruptions or crashes, potentially impacting availability of systems handling sensitive data under GDPR or HIPAA.

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or later for the 4.1.x branch, or to version 4.2.16.Final or later for the 4.2.x branch to address the memory leak in SpdyHttpDecoder.

Hi! I’m here to help you understand CVE-2026-56745. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70