{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/netty-codec-http-4.1.0.final---4.1.135.final/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-55831"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-codec-http (4.2.0.Final - 4.2.15.Final)","netty-codec-http (4.1.0.Final - 4.1.135.Final)","netty-codec-http (\u003e= 4.2.0.Final, \u003c= 4.2.15.Final)","netty-codec-http (\u003e= 4.1.0.Final, \u003c= 4.1.135.Final)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability","netty","spdy","java","memory-leak","DoS"],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eA remote unauthenticated denial of service vulnerability, identified as CVE-2026-55831, affects Netty's \u003ccode\u003enetty-codec-http\u003c/code\u003e library, specifically versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. The flaw lies within the SPDY SETTINGS decoder, which does not impose an implementation-level cap on the number of unique setting IDs it will accept and materialize in its \u003ccode\u003eDefaultSpdySettingsFrame\u003c/code\u003e's internal \u003ccode\u003eTreeMap\u003c/code\u003e. Attackers can exploit this by sending a specially crafted SPDY/3.1 SETTINGS frame containing up to 262,144 unique setting IDs. This leads to significant heap memory exhaustion, estimated at 17-18 MiB per frame, and high CPU utilization due to ordered-map insertion work, effectively rendering the affected Netty application unresponsive. The vulnerability highlights a critical resource management oversight in handling protocol-level data that can be manipulated by external parties.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA remote, unauthenticated attacker establishes a network connection to a server running an affected Netty application that utilizes \u003ccode\u003eSpdyFrameCodec\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious SPDY/3.1 SETTINGS frame, ensuring it is syntactically valid according to the SPDY specification.\u003c/li\u003e\n\u003cli\u003eThe crafted frame includes a large number of unique 24-bit setting IDs, up to the maximum allowed by the 24-bit frame-length limit, such as 262,144 entries.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eSpdyFrameCodec.decode()\u003c/code\u003e method receives the inbound SPDY bytes, including the malicious SETTINGS frame.\u003c/li\u003e\n\u003cli\u003eThe decoder reads the peer-controlled flags and 24-bit frame length, accepting the SETTINGS frame as valid if \u003ccode\u003elength \u0026gt;= 4\u003c/code\u003e and the payload is divisible into 8-byte entries matching the \u003ccode\u003enumSettings\u003c/code\u003e count.\u003c/li\u003e\n\u003cli\u003eFor each unique setting ID and value pair supplied by the attacker, the \u003ccode\u003eDefaultSpdySettingsFrame.setValue()\u003c/code\u003e method is called, which inserts a new \u003ccode\u003eSetting\u003c/code\u003e into its internal \u003ccode\u003eTreeMap\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDue to the absence of a count budget or size limit during \u003ccode\u003eTreeMap\u003c/code\u003e insertion, the \u003ccode\u003eDefaultSpdySettingsFrame\u003c/code\u003e materializes all 262,144 attacker-controlled entries.\u003c/li\u003e\n\u003cli\u003eThis process consumes approximately 17-18 MiB of heap memory and significant CPU cycles for ordered-map insertions per frame, leading to a resource-exhaustion denial of service for the Netty application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-55831 by a remote unauthenticated network peer results in a denial of service condition for applications utilizing affected Netty versions (v4.2.0.Final-4.2.15.Final and v4.1.0.Final-4.1.135.Final) with \u003ccode\u003eSpdyFrameCodec\u003c/code\u003e. The attack causes substantial heap memory growth (approx. 17-18 MiB per decoded frame) and high CPU utilization due to the unbounded insertion of attacker-controlled entries into a \u003ccode\u003eTreeMap\u003c/code\u003e. This resource exhaustion will render the application unresponsive, preventing it from serving legitimate users and potentially requiring manual intervention to restore service. The attack does not require authentication and can be executed over the network, making it a severe threat to the availability of affected services.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-55831 immediately by updating \u003ccode\u003emaven/io.netty:netty-codec-http\u003c/code\u003e to a patched version (e.g., above 4.2.15.Final or 4.1.135.Final) to prevent resource-exhaustion denial of service.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for sudden, unexplained increases in memory consumption or CPU utilization in Netty applications, which could indicate attempts to exploit CVE-2026-55831.\u003c/li\u003e\n\u003cli\u003eImplement network intrusion detection systems (NIDS) to monitor for unusually large or malformed SPDY/3.1 SETTINGS frames that match the characteristics described in the attack chain.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T21:34:03Z","date_published":"2026-07-22T21:08:13Z","id":"https://feed.craftedsignal.io/briefs/2026-07-netty-spdy-dos/","summary":"A high-severity vulnerability, CVE-2026-55831, in Netty's SPDY SETTINGS decoder allows a remote unauthenticated attacker to trigger a denial of service by sending a crafted SPDY/3.1 SETTINGS frame that leads to excessive heap growth and CPU consumption due to unbounded map entries in `DefaultSpdySettingsFrame`.","title":"Netty SPDY SETTINGS Frame Denial of Service Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-netty-spdy-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Codec-Http (4.1.0.Final - 4.1.135.Final)","version":"https://jsonfeed.org/version/1.1"}