Netty · Netty · CVE-2026-33871
**Name of the Vulnerable Software and Affected Versions**
Netty versions prior to 4.1.132.Final and versions prior to 4.2.10.Final
**Description**
Netty, an asynchronous, event-driven network application framework, is susceptible to a Denial of Service (DoS) attack. A remote user can exploit this by sending a flood of `CONTINUATION` frames to a Netty HTTP/2 server. The server does not limit the number of `CONTINUATION` frames it accepts, and existing size-based protections are bypassed when zero-byte frames are used. This allows an attacker to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. The issue resides in the `DefaultHttp2FrameReader` component, specifically within the `verifyContinuationFrame()` function, which lacks a frame count check. The `HeadersBlockBuilder.addFragment()` function also allows bypassing the byte limit with zero-byte frames.
**Recommendations**
Upgrade to Netty version 4.1.132.Final or later.
Upgrade to Netty version 4.2.10.Final or later.