CVE-2026-56819High· 7.5▾ MidnightPoC availableA flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompress…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.4%
1 GitHub repo
Last analysed / modified upstream
A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing the application to crash and resulting in a Denial of Service (DoS). The issue occurs because the framework fails to release retained memory buffers when processing DATA frames for a stream whose decompressor has already been closed.
io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak — rated Important by Red Hat. Released 2026-07-21, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333 Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.
The References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2026:66488 Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2026:48118
Workarounds / mitigations:
Affected packages:
io.netty:netty-codec-http2 >= 4.2.0, <= 4.2.15.Finalio.netty:netty-codec-http2 >= 4.1.0.Final, <= 4.1.135.FinalPatched in:
io.netty:netty-codec-http2 4.2.16.Finalio.netty:netty-codec-http2 4.1.136.FinalField changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55831High· 7.5io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)
CVE-2026-55833High· 7.5netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833)
CVE-2026-56745High· 7.5netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745)
CVE-2026-73566High· 7.5node-tar is a tar archive manipulation library for Node.js
CVE-2026-56746High· 7.5io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746)
CVE-2026-59899High· 7.5io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899)