CVE-2026-55831 Details
Description
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
A denial-of-service vulnerability has been identified in Netty's handling of SPDY SETTINGS frames, present in versions 4.1.0.Final prior to 4.1.136.Final and 4.2.0.Final prior to 4.2.16.Final. The issue arises because the SPDY SETTINGS decoder allows a remote SPDY/3.1 peer to send a large SETTINGS frame that exceeds normal processing limits. This frame can be syntactically valid and approximately 2 MiB in size, leading to the creation of 262,144 entries in a settings map. The vulnerability causes excessive memory usage and CPU workload due to the unbounded number of entries being processed and inserted into a TreeMap, which is reflected in a significant increase in heap memory consumption.
Users can upgrade to Netty versions 4.1.136.Final or 4.2.16.Final, both of which include the necessary fix to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netty netty | >= 4.1.0, < 4.1.136 >= 4.2.0, < 4.2.16 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | Reanalysis | [email protected] |
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | New CVE Received | [email protected] |