High severity · published Jul 21, 2026
CVE-2026-56745
Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netty · netty
>= 4.2.0.Final, < 4.2.16.Final; >= 4.1.0.Final, < 4.1.136.Final · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56745
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56745
Patch
https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
Patch
https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
Release Notes
https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
Release Notes
https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
Vendor Advisory
https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq
More from netty
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2026-47691
Netty has Insufficient Bailiwick Validation for NS Records
10.0
CVE-2026-45674
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
9.8
CVE-2026-56817
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
9.8
CVE-2026-42581
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization