Junglewise Threat Intelligence

CVE-2026-33871: Netty Denial of Service via HTTP/2 CONTINUATION frame flood

CVE-2026-33871 · Severity: high · CVSS 7.5 · Published 2026-03-27

Technologies: Netty Project Netty. Vendors: Red Hat, Netty Project.

Executive brief

Netty is a widely used networking framework that helps Java applications communicate over the internet. A vulnerability in its handling of HTTP/2 traffic allows a remote attacker to overwhelm a server's processor (CPU) by sending a flood of specific empty data packets. This can cause the server to become completely unresponsive, leading to a service outage for legitimate customers and users.

Technical details

The vulnerability exists in Netty's DefaultHttp2FrameReader component. When an HTTP/2 HEADERS frame is received without the END_HEADERS flag, the server expects CONTINUATION frames; however, the verifyContinuationFrame() method fails to enforce a limit on the number of these frames. Furthermore, the existing maxHeaderListSize mitigation is bypassed when an attacker sends zero-byte payloads, as the size-based check is never triggered. An unauthenticated remote attacker can exploit this by sending a continuous stream of zero-byte CONTINUATION frames, exhausting CPU resources on the handling thread. The issue is fixed in versions 4.1.132.Final and 4.2.10.Final.

Affected products

  • Netty Project Netty < 4.1.132.Final, < 4.2.10.Final
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat OpenShift Dev Spaces 3.27.1

Timeline

  • 2026-03-24: advisory: GitHub Security Advisory published by Netty project
  • 2026-03-27: disclosed: NVD publication date
  • 2026-04-23: patched: Red Hat released security updates for affected products

References