CVE-2026-56745 netty CVE debrief

Who should care

Users of Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes upgrading to a fixed version of Netty, such as 4.1.136.Final or 4.2.16.Final, and implementing compensating controls to detect and prevent potential attacks.

Technical summary

The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec is vulnerable to memory exhaustion. When a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` is processed, the decoder allocates a pooled `ByteBuf` and stores the partially constructed `FullHttpRequest` in `messageMap`. However, when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion.

Defensive priority

High

Recommended defensive actions

• Upgrade to Netty version 4.1.136.Final or 4.2.16.Final
• Implement compensating controls to detect and prevent potential attacks
• Monitor for unusual network activity and system resource usage
• Perform regular inventory checks to ensure all Netty instances are up-to-date and patched
• Review and verify the configuration of Netty instances to prevent exploitation
• Conduct regular security audits to identify potential vulnerabilities
• Track and analyze network traffic for suspicious activity related to Netty

Evidence notes

The CVE record was published on 2026-07-21T22:17:14.500Z and was last modified on 2026-07-22T20:35:40.827Z. The NVD entry is currently Awaiting Analysis. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity.

Official resources