CVE-2026-56816

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in Netty via HTTP/3 Reserved Frames

Publication date: 2026-07-21

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-07

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-56816

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	From 4.2.2 (inc) to 4.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in Netty's Http3FrameCodec allows an attacker to send HTTP/3 reserved frames with very large payload lengths. The system buffers this data without limits, leading to memory exhaustion and denial of service by opening multiple QUIC streams.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual memory usage or network traffic patterns associated with HTTP/3 reserved frames. Check for excessive memory consumption in Netty applications using system monitoring tools like top, htop, or ps. Inspect QUIC streams for abnormally large payload lengths in reserved frames using network analysis tools such as Wireshark or tcpdump.

Impact Analysis

An attacker could exploit this to crash your application or server by consuming excessive memory, causing downtime or service disruption. Systems using Netty for HTTP/3 protocols are at risk.

Compliance Impact

This vulnerability could lead to denial of service attacks, potentially disrupting services handling sensitive data. For GDPR, such disruptions may impact availability of personal data processing systems, requiring incident response and potential breach notifications. For HIPAA, service outages could affect protected health information systems, necessitating risk assessments and mitigation efforts.

Mitigation Strategies

Upgrade Netty to version 4.2.16.Final or later to address the memory exhaustion issue in Http3FrameCodec.

Hi! I’m here to help you understand CVE-2026-56816. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70