CVE-2026-56819: Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed, Http2Decompressor.decompress(...) calls decompressor.writeInbound(data.retain()) and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nettyto a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
nettyto a version that resolves this vulnerability.Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56819?
CVE-2026-56819 has a severity rating of high with a score of 7.5.
How do I fix CVE-2026-56819?
To fix CVE-2026-56819, update Netty to version 4.2.16.Final or later.
What kind of vulnerability is CVE-2026-56819?
CVE-2026-56819 is an information leak vulnerability that can result in a direct memory leak and Out of Memory DoS.
Who can exploit CVE-2026-56819?
CVE-2026-56819 can be exploited by a remote unauthenticated peer.
What versions of Netty are affected by CVE-2026-56819?
CVE-2026-56819 affects Netty versions 4.2.0.Final to 4.2.15.Final and 4.1.0.Final to 4.1.135.Final.