PT-2026-61745 · Netty · Netty

CVE-2026-55833 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description An issue exists in the SPDY header decoding process where the system continues inflating zlib-compressed header blocks even after the raw header parser has exceeded the maxHeaderSize and marked the frame as truncated in SpdyFrameCodec. This allows a remote peer to send a small compressed HEADERS block that expands into significantly larger raw header data, leading to compression-amplified CPU and allocation churn, which can result in a Denial of Service.

Recommendations Update to version 4.1.136.Final. Update to version 4.2.16.Final.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-55833

Affected Products

Netty

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-55833 · Security Note
• https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c · Note
• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Note
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note
• https://twitter.com/VulmonFeeds/status/2079404355376062498 · Twitter Post