PT-2026-28108 · Netty+2 · Netty+2
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Netty versions prior to 4.1.132.Final and versions prior to 4.2.10.Final
Description
Netty, an asynchronous, event-driven network application framework, is susceptible to a Denial of Service (DoS) attack. A remote user can exploit this by sending a flood of
CONTINUATION frames to a Netty HTTP/2 server. The server does not limit the number of CONTINUATION frames it accepts, and existing size-based protections are bypassed when zero-byte frames are used. This allows an attacker to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. The issue resides in the DefaultHttp2FrameReader component, specifically within the verifyContinuationFrame() function, which lacks a frame count check. The HeadersBlockBuilder.addFragment() function also allows bypassing the byte limit with zero-byte frames.Recommendations
Upgrade to Netty version 4.1.132.Final or later.
Upgrade to Netty version 4.2.10.Final or later.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Confluence
Netty
Red Os