CVE-2026-42587

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

At a glance

Severity: HIGH 7.5
EPSS: EPSS 0.99 % · percentile 62 (2026-10-27)
State: PUBLISHED
Published: 2026-05-13
Updated: 2026-09-18
Assigner: GitHub_M
NVD status: Modified

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	redhat-SADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Weaknesses (CWE)

Advisories

GHSA-f6hv-jmp6-3vwv — Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS

European references

ENISA EUVD · EUVD-2026-30130
GCVE · GCVE-0-2026-42587

CERT-FR advisories

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1336 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1206 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1032 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0986 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0810 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0773 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.133
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.13

Affected products

Product	Versions
netty · netty	affected >= 4.2.0.Alpha1, < 4.2.13.Final ; affected < 4.1.133.Final
io.netty · netty-codec-http	affected >= 4.2.0.Alpha1, < 4.2.13.Final ; affected < 4.1.133.Final
io.netty · netty-codec-http2	affected >= 4.2.0.Alpha1, < 4.2.13.Final ; affected < 4.1.133.Final

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD