CVE-2026-55831

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Uncontrolled Resource Consumption pada netty. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

23 Juli 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w exploit · advisory vendor
• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b patch
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 patch
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final release notes
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final release notes