CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
En bref
- Source
- NVD
- EPSS
- EPSS 0.66 % · centile 52 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- GitHub_M
- Statut NVD
- Analyzed
Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Faiblesses (CWE)
- CWE-400 — Consommation de ressources non maîtrisée (déni de service)
- CWE-401 — Mémoire non libérée après sa durée de vie utile
Références
- https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GitHub_M |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · security-advisories@github.com (Secondary) |
Avis
- GHSA-93wv-jw9v-4972 — Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Références européennes
- ENISA EUVD · EUVD-2026-47581
- GCVE · GCVE-0-2026-56819
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1336 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0991 — Multiples vulnérabilités dans VMware Tanzu Greenplum · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.136cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.16
Produits affectés
| Produit | Versions |
|---|---|
| netty · netty | affected >= 4.2.0.Final, < 4.2.16.Final ; affected >= 4.1.0.Final, < 4.1.136.Final |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |