CVE-2026-56819 Details
Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
A memory leak vulnerability has been identified in Netty, specifically in the HTTP/2 codec, versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. When HTTP/2 content decompression is enabled, a remote, unauthenticated peer can cause a direct ByteBuf leak with each DATA frame sent. This occurs because the Http2Decompressor retains the frame buffer without releasing it if the associated stream's decompressor has already been closed. The retained buffers accumulate, leading to direct memory exhaustion and a JVM crash due to OutOfMemoryError, effectively causing a denial-of-service condition.
Users can upgrade to Netty versions 4.2.16.Final or 4.1.136.Final, both of which include the necessary fix to prevent the buffer leak.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| netty netty | >= 4.1.0, < 4.1.136 >= 4.2.0, < 4.2.16 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | CVE Modified | [email protected] |
| Jul 21, 2026 | New CVE Received | [email protected] |