CVE-2026-55833

EUVD-2026-46133

21.07.2026, 00:17

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 35.46%

Affected Products (NVD)

Vendor	Product	Version
netty	netty	4.1.0 ≤ 𝑥 < 4.1.136
netty	netty	4.2.0 ≤ 𝑥 < 4.2.16

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

netty

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

netty

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
trusty	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

netty-tcnative

suse enterprise desktop 15 SP7	2.0.80-150200.3.48.1 fixed
suse enterprise sap 15 SP4	2.0.80-150200.3.48.1 fixed
suse enterprise sap 15 SP5	2.0.80-150200.3.48.1 fixed
suse enterprise sap 15 SP6	2.0.80-150200.3.48.1 fixed
suse enterprise sap 15 SP7	2.0.80-150200.3.48.1 fixed
suse enterprise server 15 SP4	2.0.80-150200.3.48.1 fixed
suse enterprise server 15 SP5	2.0.80-150200.3.48.1 fixed
suse enterprise server 15 SP6	2.0.80-150200.3.48.1 fixed
suse enterprise server 15 SP7	2.0.80-150200.3.48.1 fixed

Known Exploits!

https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c

Common Weakness Enumeration

CWE-400 - Uncontrolled Resource Consumption
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Vulnerability Media Exposure

[GERMAN] Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
Published: 2026-08-18T22:00:00+00:00

References

https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b

https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6

https://github.com/netty/netty/releases/tag/netty-4.1.136.Final

https://github.com/netty/netty/releases/tag/netty-4.2.16.Final

https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c