PT-2026-63258 · Netty · Netty

CVE-2026-56819 · Published 2026-07-21 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.135.Final Netty versions 4.2.0.Final through 4.2.15.Final

Description A remote unauthenticated peer can cause a memory leak of one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression using DelegatingDecompressorFrameListener. The issue occurs when a DATA frame is processed for a stream with a closed decompressor; the Http2Decompressor.decompress() function calls decompressor.writeInbound(data.retain()) but fails to release the retained buffer during the error path. This leads to the exhaustion of direct memory and causes the JVM to crash.

Recommendations Update to version 4.1.136.Final Update to version 4.2.16.Final

Exploit

Fix

Memory Leak

Resource Exhaustion

Weakness Enumeration

CWE-401

CWE-400

Related Identifiers

CVE-2026-56819

GHSA-93WV-JW9V-4972

Affected Products

Netty

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56819.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-56819 · Security Note
• https://osv.dev/vulnerability/CVE-2026-56819 · Vendor Advisory
• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note
• https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972 · Note
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final · Note