PT-2026-61744 · Netty · Netty

CVE-2026-55831 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description The SPDY SETTINGS decoder in Netty allows a remote SPDY/3.1 peer to send a syntactically valid SETTINGS frame of approximately 2 MiB. This frame can contain a peer-declared SETTINGS entry count up to the 24-bit frame-length limit, which the DefaultSpdySettingsFrame then materializes for every unique setting ID. This process amplifies network input into significant heap growth and ordered-map insertion work, potentially leading to a denial of service.

Recommendations Update to version 4.1.136.Final or later. Update to version 4.2.16.Final or later.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-55831

Affected Products

Netty

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-55831 · Security Note
• https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w · Note
• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b · Note
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note
• https://twitter.com/VulmonFeeds/status/2079401794371748135 · Twitter Post