CVE-2026-56816High· 7.5▾ TwilightA flaw was found in Netty. An unauthenticated remote attacker can exploit a vulnerability in Netty's `Http3FrameCodec` by sending specially crafted HTTP/3 reserved frames with excessive payload lengths. This can lead to uncontrolled memory…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.6%
Last analysed / modified upstream
A flaw was found in Netty. An unauthenticated remote attacker can exploit a vulnerability in Netty's Http3FrameCodec by sending specially crafted HTTP/3 reserved frames with excessive payload lengths. This can lead to uncontrolled memory buffering, causing memory exhaustion and a denial of service (DoS) for the affected system.
io.netty:netty-codec-http3: Netty: Denial of Service due to uncontrolled memory buffering in HTTP/3 — rated Important by Red Hat. Released 2026-07-21, updated 2026-09-29.
Not affected:
Refer to the advisory for fix availability.
Affected packages:
io.netty:netty-codec-http3 < 4.2.16.FinalPatched in:
io.netty:netty-codec-http3 4.2.16.FinalConnected by shared product, vendor, weakness, or advisory.
CVE-2026-112915Medium· 5.5filelock: filelock: Denial of Service via crafted SQLite lock database (CVE-2026-112915)
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)
CVE-2026-68498High· 7.5com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON propert…
CVE-2026-67318Medium· 5.3axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2
CVE-2026-108106High· 7.5Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input
CVE-2026-116141Medium· 5.3ImageMagick: ImageMagick: Denial of Service via policy bypass in UHDR decoder (CVE-2026-116141)