CVE-2026-56819

Analyzed Analyzed - Analysis Complete

Netty HTTP/2 Data Frame Memory Leak via DelegatingDecompressorFrameListener

Publication date: 2026-07-21

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-30

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-56819

EUVD

EUVD-2026-47581

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	From 4.1.0 (inc) to 4.1.136 (exc)
netty	netty	From 4.2.0 (inc) to 4.2.16 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects Netty, a network application framework, in versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. It allows a remote unauthenticated attacker to leak one direct ByteBuf per HTTP/2 DATA frame when HTTP/2 content decompression is enabled via DelegatingDecompressorFrameListener. The issue occurs when processing a DATA frame for a stream with a closed decompressor, causing memory exhaustion and JVM crashes.

Detection Guidance

Detecting this vulnerability requires checking if your Netty version is within the affected range (4.2.0.Final to 4.2.15.Final or 4.1.0.Final to 4.1.135.Final) and if HTTP/2 content decompression is enabled via DelegatingDecompressorFrameListener. Monitor JVM memory usage for direct ByteBuf leaks during HTTP/2 traffic processing.

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) attacks by exhausting direct memory, causing the JVM to crash. Systems using vulnerable Netty versions with HTTP/2 content decompression enabled are at risk of unexpected shutdowns and service disruption.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing service disruptions due to JVM crashes from memory exhaustion. Unavailability of systems handling personal or health data could violate availability requirements under these regulations.

Mitigation Strategies

Upgrade Netty to versions 4.1.136.Final or 4.2.16.Final or later. If upgrading is not immediately possible, disable HTTP/2 content decompression in DelegatingDecompressorFrameListener or restrict access to HTTP/2 endpoints until patched.

Hi! I’m here to help you understand CVE-2026-56819. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70