CVE-2026-56745High· 7.5▾ TwilightA flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory i…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.6%
7.5 → —
— → 7.5
7.5 → —
— → 7.5
7.5 → —
— → 7.5
7.5 → —
— → 7.5
7.5 → —
— → 7.5
7.5 → —
— → 7.5
0.6% → 0.6%
Last analysed / modified upstream
A flaw was found in Netty. A remote attacker can exploit a vulnerability in the SpdyHttpDecoder handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated SYN_STREAM frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.
netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec — rated Important by Red Hat. Released 2026-07-21, updated 2026-10-20.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:70230 Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:70228 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333
Affected packages:
io.netty:netty-codec-http >= 4.2.0.Final, <= 4.2.15.Finalio.netty:netty-codec-http >= 4.1.0.Final, <= 4.1.135.FinalPatched in:
io.netty:netty-codec-http 4.2.16.Finalio.netty:netty-codec-http 4.1.136.FinalField changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55831High· 7.5io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)
CVE-2026-55833High· 7.5netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833)
CVE-2026-56746High· 7.5io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746)
CVE-2026-59899High· 7.5io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899)
CVE-2026-54512High· 8.1jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
CVE-2026-54513High· 8.1jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)