PatchSiren cyber security CVE debrief
CVE-2026-56819 netty CVE debrief
CVE-2026-56819 is a high-severity vulnerability affecting Netty, a network application framework used for developing protocol servers and clients. The issue, rated with a CVSS score of 7.5, allows a remote unauthenticated peer to cause memory exhaustion by leaking one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. This occurs when a DATA frame is processed for a stream whose decompressor has already been closed, leading to a failure in releasing the retained buffer on the error path. This can eventually exhaust direct memory and crash the JVM. The vulnerability affects Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. It is fixed in versions 4.1.136.Final and 4.2.16.Final.
- Vendor
- netty
- Product
- Unknown
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Organizations using Netty for network application development, especially those enabling HTTP/2 content decompression, should prioritize patching to prevent potential memory exhaustion attacks.
Technical summary
The vulnerability arises from the improper handling of HTTP/2 DATA frames in Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. When a DATA frame is processed for a stream with a closed decompressor, Http2Decompressor.decompress(...) retains the buffer but fails to release it on the error path. This leads to a gradual exhaustion of direct memory, potentially causing the JVM to crash. The issue is addressed in Netty versions 4.1.136.Final and 4.2.16.Final.
Defensive priority
High
Recommended defensive actions
- Apply patches: Upgrade to Netty version 4.1.136.Final or 4.2.16.Final.
- Inventory checks: Verify if applications using Netty have HTTP/2 content decompression enabled.
- Monitoring: Implement monitoring for memory usage and JVM crashes.
- Exception tracking: Track exceptions related to memory exhaustion or JVM crashes.
- Retest: Validate the fix in a controlled environment.
Evidence notes
The CVE record was published on 2026-07-21T23:17:52.263Z and was last modified on 2026-07-22T20:35:40.827Z. The NVD entry is currently Awaiting Analysis. Official references include commits and release notes from the Netty project.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T23:17:52.263Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.