{"id":"CVE-2026-56745","title":"netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745)","summary":"A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory i…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-772","CWE-400"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces 3.30","affected":["openshift_serverless","amq_clients","build_of_apache_camel_hawtio 4","build_of_apache_camel_4_for_quarkus 3","build_of_apicurio_registry 3","build_of_debezium 3","build_of_keycloak","data_grid 8","enterprise_linux_ai_rhel_ai 3","jboss_enterprise_application_platform 7","jboss_enterprise_application_platform 8","openshift_dev_spaces","single_sign_on 7","streams_for_apache_kafka 2","cryostat_4_on_rhel 9","amq_broker 7.13.6","amq_broker 7.14.1","build_of_apache_camel_4_18_for_quarkus 3.33","data_grid 8.6.3","openshift_ai 2.25","openshift_dev_spaces 3.30","build_of_apache_camel_4_18_3_for_spring_boot 3.5.16","build_of_quarkus 3.27.4.SP3","build_of_quarkus 3.33.2.SP3","streams_for_apache_kafka 3.2.1"],"patched":["cryostat_4_on_rhel 9","amq_broker 7.13.6","amq_broker 7.14.1","build_of_apache_camel_4_18_for_quarkus 3.33","data_grid 8.6.3","openshift_ai 2.25","openshift_dev_spaces 3.30","build_of_apache_camel_4_18_3_for_spring_boot 3.5.16","build_of_quarkus 3.27.4.SP3","build_of_quarkus 3.33.2.SP3","streams_for_apache_kafka 3.2.1"],"published":"2026-07-21","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:19:56+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56745.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56745.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56745"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2505911"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56745"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56745"},{"url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"},{"url":"https://access.redhat.com/errata/RHSA-2026:68333"},{"url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"url":"https://access.redhat.com/errata/RHSA-2026:48118"},{"url":"https://access.redhat.com/errata/RHSA-2026:69296"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"url":"https://access.redhat.com/errata/RHSA-2026:68754"},{"url":"https://access.redhat.com/errata/RHSA-2026:54622"},{"url":"https://access.redhat.com/errata/RHSA-2026:47189"},{"url":"https://access.redhat.com/errata/RHSA-2026:47172"},{"url":"https://access.redhat.com/errata/RHSA-2026:54435"},{"url":"https://github.com/advisories/GHSA-jppx-w49h-x2qq"}],"tags":["csaf","vex","red-hat","ghsa","maven"],"epss":0.00612,"epssPercentile":0.47655,"aliases":["GHSA-jppx-w49h-x2qq"],"ecosystem":"maven","ingestedAt":"2026-07-22T22:06:57.946Z","slug":"CVE-2026-56745","body":"## Overview\n\nA flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.\n\n## Vendor advisories\n\n- **RHSA-2026:68333** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68333)\n- **RHSA-2026:66545** · Red Hat · fixed in: Red Hat AMQ Broker 7.13.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66545)\n- **RHSA-2026:66488** · Red Hat · fixed in: Red Hat AMQ Broker 7.14.1 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66488)\n- **RHSA-2026:48118** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48118)\n- **RHSA-2026:69296** · Red Hat · fixed in: Red Hat Data Grid 8.6.3 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69296)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:62260** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62260)\n- **RHSA-2026:68754** · Red Hat · fixed in: Red Hat OpenShift Dev Spaces 3.30 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68754)\n- **RHSA-2026:54622** · Red Hat · fixed in: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54622)\n- **RHSA-2026:47189** · Red Hat · fixed in: Red Hat build of Quarkus 3.27.4.SP3 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:47189)\n- **RHSA-2026:47172** · Red Hat · fixed in: Red Hat build of Quarkus 3.33.2.SP3 · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:47172)\n- **Red Hat VEX** · Important · affected: OpenShift Serverless, Red Hat AMQ Clients, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, … · no fix planned: Red Hat build of Debezium 3, Red Hat JBoss Enterprise Application Platform 7, OpenShift Serverless, Red Hat AMQ Clients, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56745.json)\n- **RHSA-2026:54435** · Red Hat · fixed in: Streams for Apache Kafka 3.2.1 · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54435)\n\n**netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec** — rated Important by Red Hat. Released 2026-07-21, updated 2026-09-21.\n\nAffected:\n\n- OpenShift Serverless\n- Red Hat AMQ Clients\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apicurio Registry 3\n- Red Hat build of Debezium 3\n- Red Hat Build of Keycloak\n- Red Hat Data Grid 8\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat OpenShift Dev Spaces\n- Red Hat Single Sign-On 7\n- streams for Apache Kafka 2\n\nFixed:\n\n- Cryostat 4 on RHEL 9\n- Red Hat AMQ Broker 7.13.6\n- Red Hat AMQ Broker 7.14.1\n- Red Hat Build of Apache Camel 4.18 for Quarkus 3.33\n- Red Hat Data Grid 8.6.3\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift Dev Spaces 3.30\n- Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16\n- Red Hat build of Quarkus 3.27.4.SP3\n- Red Hat build of Quarkus 3.33.2.SP3\n- Streams for Apache Kafka 3.2.1\n\nNo fix planned:\n\n- Red Hat build of Debezium 3\n- Red Hat JBoss Enterprise Application Platform 7\n- OpenShift Serverless\n- Red Hat AMQ Clients\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apicurio Registry 3\n- Red Hat Build of Keycloak\n- Red Hat Data Grid 8\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat JBoss Enterprise Application Platform 8\n- Red Hat OpenShift Dev Spaces\n- Red Hat Single Sign-On 7\n- streams for Apache Kafka 2\n\nNot affected:\n\n- Cryostat 4 on RHEL 9\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift Dev Spaces 3.30\n- Red Hat JBoss Enterprise Application Platform 7\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333\nBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2026:66545\nBefore applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.\n\nThe References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2026:66488\n\n## Package advisory (CVE-2026-56745)\n\nAffected packages:\n\n- `io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.15.Final`\n- `io.netty:netty-codec-http >= 4.1.0.Final, <= 4.1.135.Final`\n\nPatched in:\n\n- `io.netty:netty-codec-http 4.2.16.Final`\n- `io.netty:netty-codec-http 4.1.136.Final`\n\nSource: https://github.com/advisories/GHSA-jppx-w49h-x2qq","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201789,"id":"CVE-2026-56745","ts":1789399725590,"field":"cvss","old":null,"new":"7.5"},{"seq":200519,"id":"CVE-2026-56745","ts":1789397373555,"field":"cvss","old":"7.5","new":null},{"seq":198436,"id":"CVE-2026-56745","ts":1789391968542,"field":"cvss","old":null,"new":"7.5"},{"seq":196229,"id":"CVE-2026-56745","ts":1789383584988,"field":"cvss","old":"7.5","new":null},{"seq":195158,"id":"CVE-2026-56745","ts":1789380474792,"field":"cvss","old":null,"new":"7.5"},{"seq":193945,"id":"CVE-2026-56745","ts":1789378514162,"field":"cvss","old":"7.5","new":null},{"seq":192732,"id":"CVE-2026-56745","ts":1789376406853,"field":"cvss","old":null,"new":"7.5"},{"seq":191519,"id":"CVE-2026-56745","ts":1789373419470,"field":"cvss","old":"7.5","new":null},{"seq":190304,"id":"CVE-2026-56745","ts":1789369298191,"field":"cvss","old":null,"new":"7.5"},{"seq":189091,"id":"CVE-2026-56745","ts":1789368266739,"field":"cvss","old":"7.5","new":null},{"seq":187874,"id":"CVE-2026-56745","ts":1789365143084,"field":"cvss","old":null,"new":"7.5"},{"seq":186661,"id":"CVE-2026-56745","ts":1789363271155,"field":"cvss","old":"7.5","new":null},{"seq":185447,"id":"CVE-2026-56745","ts":1789361101036,"field":"cvss","old":null,"new":"7.5"},{"seq":184234,"id":"CVE-2026-56745","ts":1789358155445,"field":"cvss","old":"7.5","new":null},{"seq":182485,"id":"CVE-2026-56745","ts":1789354222222,"field":"cvss","old":null,"new":"7.5"},{"seq":181278,"id":"CVE-2026-56745","ts":1789353120357,"field":"cvss","old":"7.5","new":null},{"seq":180071,"id":"CVE-2026-56745","ts":1789350168865,"field":"cvss","old":null,"new":"7.5"},{"seq":178864,"id":"CVE-2026-56745","ts":1789348100956,"field":"cvss","old":"7.5","new":null},{"seq":177657,"id":"CVE-2026-56745","ts":1789346277349,"field":"cvss","old":null,"new":"7.5"},{"seq":176450,"id":"CVE-2026-56745","ts":1789343018554,"field":"cvss","old":"7.5","new":null},{"seq":174567,"id":"CVE-2026-56745","ts":1789334771361,"field":"cvss","old":null,"new":"7.5"},{"seq":173362,"id":"CVE-2026-56745","ts":1789333507079,"field":"cvss","old":"7.5","new":null},{"seq":172176,"id":"CVE-2026-56745","ts":1789331017803,"field":"cvss","old":null,"new":"7.5"},{"seq":170990,"id":"CVE-2026-56745","ts":1789328614364,"field":"cvss","old":"7.5","new":null},{"seq":169785,"id":"CVE-2026-56745","ts":1789327050742,"field":"cvss","old":null,"new":"7.5"},{"seq":168580,"id":"CVE-2026-56745","ts":1789323659543,"field":"cvss","old":"7.5","new":null},{"seq":167375,"id":"CVE-2026-56745","ts":1789319578431,"field":"cvss","old":null,"new":"7.5"},{"seq":166170,"id":"CVE-2026-56745","ts":1789318560241,"field":"cvss","old":"7.5","new":null},{"seq":164965,"id":"CVE-2026-56745","ts":1789315703499,"field":"cvss","old":null,"new":"7.5"},{"seq":163760,"id":"CVE-2026-56745","ts":1789313451572,"field":"cvss","old":"7.5","new":null},{"seq":162555,"id":"CVE-2026-56745","ts":1789311820294,"field":"cvss","old":null,"new":"7.5"},{"seq":161350,"id":"CVE-2026-56745","ts":1789308524388,"field":"cvss","old":"7.5","new":null},{"seq":160855,"id":"CVE-2026-56745","ts":1789304474736,"field":"cvss","old":null,"new":"7.5"},{"seq":160402,"id":"CVE-2026-56745","ts":1789303983162,"field":"cvss","old":"7.5","new":null},{"seq":159463,"id":"CVE-2026-56745","ts":1789300401980,"field":"cvss","old":null,"new":"7.5"},{"seq":158693,"id":"CVE-2026-56745","ts":1789299494947,"field":"cvss","old":"7.5","new":null},{"seq":157657,"id":"CVE-2026-56745","ts":1789296581758,"field":"cvss","old":null,"new":"7.5"},{"seq":156452,"id":"CVE-2026-56745","ts":1789294595891,"field":"cvss","old":"7.5","new":null},{"seq":155247,"id":"CVE-2026-56745","ts":1789292790843,"field":"cvss","old":null,"new":"7.5"},{"seq":154042,"id":"CVE-2026-56745","ts":1789289590518,"field":"cvss","old":"7.5","new":null},{"seq":152692,"id":"CVE-2026-56745","ts":1789281508217,"field":"cvss","old":null,"new":"7.5"},{"seq":152332,"id":"CVE-2026-56745","ts":1789281110667,"field":"cvss","old":"7.5","new":null},{"seq":151293,"id":"CVE-2026-56745","ts":1789277535838,"field":"cvss","old":null,"new":"7.5"},{"seq":150254,"id":"CVE-2026-56745","ts":1789276098210,"field":"cvss","old":"7.5","new":null},{"seq":149221,"id":"CVE-2026-56745","ts":1789273737846,"field":"cvss","old":null,"new":"7.5"},{"seq":148188,"id":"CVE-2026-56745","ts":1789271121597,"field":"cvss","old":"7.5","new":null},{"seq":146223,"id":"CVE-2026-56745","ts":1789269280744,"field":"cvss","old":null,"new":"7.5"},{"seq":142835,"id":"CVE-2026-56745","ts":1789261358220,"field":"cvss","old":"7.5","new":null},{"seq":141666,"id":"CVE-2026-56745","ts":1789258741493,"field":"cvss","old":null,"new":"7.5"},{"seq":140507,"id":"CVE-2026-56745","ts":1789256582235,"field":"cvss","old":"7.5","new":null}]}