{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/netty-codec-http3--4.2.16.final/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-56816"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["netty-codec-http3 (\u003c 4.2.16.Final)"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","java","netty","http3"],"_cs_type":"advisory","_cs_vendors":["Netty"],"content_html":"\u003cp\u003eA high-severity denial-of-service vulnerability (CVE-2026-56816) has been identified in Netty's \u003ccode\u003enetty-codec-http3\u003c/code\u003e library, specifically affecting versions prior to \u003ccode\u003e4.2.16.Final\u003c/code\u003e. This flaw originates from the \u003ccode\u003eHttp3FrameCodec\u003c/code\u003e implicitly trusting the \u003ccode\u003epayLoadLength\u003c/code\u003e field in reserved HTTP/3 frames without validation. An attacker can exploit this by sending a reserved frame with a \u003ccode\u003epayLoadLength\u003c/code\u003e value up to \u003ccode\u003eInteger.MAX_VALUE\u003c/code\u003e. Despite sending only a small amount of actual data, the affected server attempts to buffer memory up to the declared payload length. By opening multiple QUIC streams and repeating this action, a malicious actor can gradually exhaust the server's memory, leading to an Out-of-Memory (OOM) error and a complete denial of service for any application utilizing the vulnerable Netty HTTP/3 codec. This vulnerability poses a significant risk to the availability of services dependent on these Netty versions.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated remote attacker establishes a QUIC connection to a server running an affected version of Netty's HTTP/3 codec.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates multiple QUIC streams on the established connection.\u003c/li\u003e\n\u003cli\u003eOn each stream, the attacker crafts and sends a reserved HTTP/3 frame (e.g., frame type \u003ccode\u003e0x40 0x40\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eWithin the reserved frame's header, the attacker specifies an extremely large \u003ccode\u003epayLoadLength\u003c/code\u003e, up to \u003ccode\u003eInteger.MAX_VALUE\u003c/code\u003e, which is read directly from the wire.\u003c/li\u003e\n\u003cli\u003eThe Netty \u003ccode\u003eHttp3FrameCodec\u003c/code\u003e (specifically \u003ccode\u003eio.netty.handler.codec.http3.Http3FrameCodec#decodeFrame\u003c/code\u003e) implicitly trusts and attempts to process this \u003ccode\u003epayLoadLength\u003c/code\u003e without any validation or upper bound enforcement for reserved frames.\u003c/li\u003e\n\u003cli\u003eThe attacker then sends only a minimal amount of actual data, significantly less than the declared \u003ccode\u003epayLoadLength\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe server's \u003ccode\u003eHttp3FrameCodec\u003c/code\u003e attempts to buffer incoming data up to the declared \u003ccode\u003epayLoadLength\u003c/code\u003e, leading to the allocation of a vast amount of memory for each active stream.\u003c/li\u003e\n\u003cli\u003eAs the attacker repeats this process across multiple QUIC streams, the server's memory is gradually exhausted, resulting in an Out-of-Memory (OOM) exception and a denial of service for the application.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of successfully exploiting CVE-2026-56816 is a denial of service (DoS) due to gradual memory exhaustion. Any application or service that integrates Netty's \u003ccode\u003enetty-codec-http3\u003c/code\u003e library, specifically versions prior to \u003ccode\u003e4.2.16.Final\u003c/code\u003e, is susceptible. An attacker can render the affected service unresponsive and unavailable by repeatedly sending specially crafted HTTP/3 reserved frames. This can lead to significant operational disruptions, loss of revenue for businesses, and reputational damage due to service outages.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-56816 immediately\u003c/strong\u003e: Upgrade all instances of \u003ccode\u003enetty-codec-http3\u003c/code\u003e to version \u003ccode\u003e4.2.16.Final\u003c/code\u003e or newer to remediate CVE-2026-56816.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMonitor server resource utilization\u003c/strong\u003e: Implement monitoring for server memory and CPU utilization on systems running Netty HTTP/3 services to detect abnormal spikes indicative of DoS attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-22T21:43:29Z","date_published":"2026-07-22T21:43:29Z","id":"https://feed.craftedsignal.io/briefs/2026-07-netty-http3-dos/","summary":"A vulnerability in Netty's HTTP/3 `Http3FrameCodec`, tracked as CVE-2026-56816, allows an unauthenticated remote attacker to cause a denial of service by sending crafted reserved HTTP/3 frames with an excessively large, unvalidated payload length, leading to server memory exhaustion.","title":"Netty HTTP/3 Codec Vulnerability Leads to Denial of Service via Memory Exhaustion","url":"https://feed.craftedsignal.io/briefs/2026-07-netty-http3-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Netty-Codec-Http3 (\u003c 4.2.16.Final)","version":"https://jsonfeed.org/version/1.1"}