VYPR
Unrated severityOSV Advisory· Published Jul 23, 2026

Debian netty: Netty is a network application framework for development of protocol servers and…

CVE-2026-56745

Description

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated SYN_STREAM frame with FLAG_FIN=0 and stores the partially constructed FullHttpRequest in messageMap; when the remote peer sends RST_STREAM for that stream or the accumulated content exceeds maxContentLength, the decoder removes the entry but does not release the pooled ByteBuf, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected products

2
  • Netty/NettyOSV2 versions
    netty-4.1.135.Final, netty-4.2.15.Final, netty-4.1.134.Final, …+ 1 more
    • (no CPE)range: netty-4.1.135.Final, netty-4.2.15.Final, netty-4.1.134.Final, …
    • (no CPE)range: 4.2.0.Final - 4.2.15.Final, 4.1.0.Final - 4.1.135.Final

Patches

Vulnerability mechanics

News mentions

0

No linked articles in our index yet.