PT-2026-62226 · Netty · Netty

CVE-2026-56745 · Published 2026-07-21 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.135.Final Netty versions 4.2.0.Final through 4.2.15.Final

Description The SpdyHttpDecoder handler in the SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated SYN STREAM frame where FLAG FIN is 0, storing the partially constructed FullHttpRequest in messageMap. If the remote peer sends a RST STREAM for that stream or the accumulated content exceeds maxContentLength, the decoder removes the entry without releasing the pooled ByteBuf, leading to native memory exhaustion.

Recommendations Update to version 4.1.136.Final Update to version 4.2.16.Final

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-56745

GHSA-JPPX-W49H-X2QQ

Affected Products

Netty

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56745.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-56745 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56745 · Security Note
• https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq · Note
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note
• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Note