{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/netty-codec-http2-4.2.x/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-56819"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-codec-http2 (4.1.x)","netty-codec-http2 (4.2.x)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","memory-leak","netty","cve-2026-56819"],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eNetty versions 4.1.x and 4.2.x are vulnerable to a direct memory leak (CWE-401) when the \u003ccode\u003eDelegatingDecompressorFrameListener\u003c/code\u003e is used for HTTP/2 content decompression. The issue occurs within the \u003ccode\u003eHttp2Decompressor.decompress()\u003c/code\u003e method, where an incoming \u003ccode\u003eByteBuf\u003c/code\u003e is retained before checking the status of the decompressor channel.\u003c/p\u003e\n\u003cp\u003eIf the decompressor channel has been closed or cleaned up, the \u003ccode\u003ewriteInbound()\u003c/code\u003e call fails with a \u003ccode\u003eClosedChannelException\u003c/code\u003e. Because the code does not perform a rollback of the reference count increment in this error path, the buffer is never released. An attacker can exploit this by sending \u003ccode\u003eDATA\u003c/code\u003e frames for streams that have already reached an \u003ccode\u003eEND_STREAM\u003c/code\u003e state or been cleaned up. Sustained exploitation causes the accumulation of unreferenced direct memory objects, leading to an \u003ccode\u003eOutOfMemoryError\u003c/code\u003e (DoS) and application crash. This affects users of \u003ccode\u003enetty-codec-http2\u003c/code\u003e across the 4.1.x and 4.2.x branches.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes a legitimate, long-lived HTTP/2 connection to a vulnerable server.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a stream and sends data frames to trigger standard decompressor processing.\u003c/li\u003e\n\u003cli\u003eAttacker sends a final frame to signal \u003ccode\u003eEND_STREAM\u003c/code\u003e, forcing the server to trigger \u003ccode\u003eonStreamRemoved\u003c/code\u003e and \u003ccode\u003eHttp2Decompressor.cleanup()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker continues to send additional \u003ccode\u003eDATA\u003c/code\u003e frames associated with the now-closed stream.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eDelegatingDecompressorFrameListener\u003c/code\u003e calls \u003ccode\u003edecompressor.writeInbound(data.retain())\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eEmbeddedChannel.ensureOpen()\u003c/code\u003e method throws a \u003ccode\u003eClosedChannelException\u003c/code\u003e because the channel is closed.\u003c/li\u003e\n\u003cli\u003eThe catch block in \u003ccode\u003eHttp2Decompressor\u003c/code\u003e fails to call \u003ccode\u003edata.release()\u003c/code\u003e on the leaked buffer.\u003c/li\u003e\n\u003cli\u003eThe direct memory is leaked; repetition of this process exhausts the heap and crashes the service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated remote attacker to cause a denial-of-service condition by crashing the JVM. This affects any application utilizing the \u003ccode\u003eDelegatingDecompressorFrameListener\u003c/code\u003e component within an HTTP/2 pipeline, which is a common pattern for high-performance network services. Repeated exploitation leads to direct memory exhaustion, which is particularly critical in containerized environments with memory limits where the OOM error occurs rapidly.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to the latest patched version of \u003ccode\u003enetty-codec-http2\u003c/code\u003e provided by the Netty Project to remediate CVE-2026-56819.\u003c/li\u003e\n\u003cli\u003eImplement an application-level rate limit on HTTP/2 streams to detect and disconnect peers that continue to send data after a stream has been closed, which serves as a mitigation until patching can occur.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, inspect the \u003ccode\u003eDelegatingDecompressorFrameListener\u003c/code\u003e implementation and manually apply the rollback logic as documented in the GHSA-93wv-jw9v-4972 advisory to ensure the reference count is decremented on failure.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-31T19:29:49Z","date_published":"2026-07-31T19:29:49Z","id":"https://feed.craftedsignal.io/briefs/2026-07-netty-memory-leak/","summary":"A vulnerability in Netty's HTTP/2 decompressor allows an unauthenticated attacker to trigger an uncontrolled memory leak leading to a JVM OutOfMemoryError via crafted HTTP/2 DATA frames.","title":"Netty HTTP/2 Decompressor Direct Memory Leak","url":"https://feed.craftedsignal.io/briefs/2026-07-netty-memory-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Codec-Http2 (4.2.x)","version":"https://jsonfeed.org/version/1.1"}