CVE-2026-56819

Katalog CVE

CVSS 7.5 · High EPSS 0,66%

Kerentanan Uncontrolled Resource Consumption pada netty. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

30 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972 exploit · advisory vendor
• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b patch
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 patch
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final release notes
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final release notes