PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56819 netty CVE debrief

CVE-2026-56819 is a high-severity vulnerability affecting Netty, a network application framework used for developing protocol servers and clients. The issue, rated with a CVSS score of 7.5, allows a remote unauthenticated peer to cause memory exhaustion by leaking one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. This occurs when a DATA frame is processed for a stream whose decompressor has already been closed, leading to a failure in releasing the retained buffer on the error path. This can eventually exhaust direct memory and crash the JVM. The vulnerability affects Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. It is fixed in versions 4.1.136.Final and 4.2.16.Final.

Vendor
netty
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-21
Original CVE updated
2026-07-22
Advisory published
2026-07-21
Advisory updated
2026-07-22

Who should care

Organizations using Netty for network application development, especially those enabling HTTP/2 content decompression, should prioritize patching to prevent potential memory exhaustion attacks.

Technical summary

The vulnerability arises from the improper handling of HTTP/2 DATA frames in Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. When a DATA frame is processed for a stream with a closed decompressor, Http2Decompressor.decompress(...) retains the buffer but fails to release it on the error path. This leads to a gradual exhaustion of direct memory, potentially causing the JVM to crash. The issue is addressed in Netty versions 4.1.136.Final and 4.2.16.Final.

Defensive priority

High

Recommended defensive actions

  • Apply patches: Upgrade to Netty version 4.1.136.Final or 4.2.16.Final.
  • Inventory checks: Verify if applications using Netty have HTTP/2 content decompression enabled.
  • Monitoring: Implement monitoring for memory usage and JVM crashes.
  • Exception tracking: Track exceptions related to memory exhaustion or JVM crashes.
  • Retest: Validate the fix in a controlled environment.

Evidence notes

The CVE record was published on 2026-07-21T23:17:52.263Z and was last modified on 2026-07-22T20:35:40.827Z. The NVD entry is currently Awaiting Analysis. Official references include commits and release notes from the Netty project.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56819 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56819

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56819 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56819

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.