# CVE-2026-33871: Netty Denial of Service via HTTP/2 CONTINUATION frame flood

Source: https://junglewise.ai/threats/cve-2026-33871-netty-denial-of-service-via-http-2-continuation-frame-flood  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33871 · Severity: high · CVSS 7.5 · Published 2026-03-27

Netty is a widely used networking framework that helps Java applications communicate over the internet. A vulnerability in its handling of HTTP/2 traffic allows a remote attacker to overwhelm a server's processor (CPU) by sending a flood of specific empty data packets. This can cause the server to become completely unresponsive, leading to a service outage for legitimate customers and users.

Technologies: [io.netty:netty-codec-http2 (Maven)](https://junglewise.ai/threats/technologies/io-netty-netty-codec-http2). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-33871 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33871 being exploited in the wild.

**How severe is CVE-2026-33871?** High severity, with a CVSS score of 7.5, published 27 March 2026.

**Which products and versions are affected?** io.netty:netty-codec-http2 (Maven) ECOSYSTEM:introduced=0,fixed=4.1.132.Final.

**Is there a fix for CVE-2026-33871?** Yes. io.netty:netty-codec-http2 (Maven): upgrade to 4.1.132.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33871 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33871?** Check whether you run io.netty:netty-codec-http2 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty:netty-codec-http2 (Maven): upgrade to 4.1.132.Final or later

  ```sh
  # set io.netty:netty-codec-http2 to 4.1.132.Final in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in Netty's DefaultHttp2FrameReader component. When an HTTP/2 HEADERS frame is received without the END_HEADERS flag, the server expects CONTINUATION frames; however, the verifyContinuationFrame() method fails to enforce a limit on the number of these frames. Furthermore, the existing maxHeaderListSize mitigation is bypassed when an attacker sends zero-byte payloads, as the size-based check is never triggered. An unauthenticated remote attacker can exploit this by sending a continuous stream of zero-byte CONTINUATION frames, exhausting CPU resources on the handling thread. The issue is fixed in versions 4.1.132.Final and 4.2.10.Final.

## Affected products

- Netty Project Netty < 4.1.132.Final, < 4.2.10.Final
- Red Hat Red Hat JBoss Enterprise Application Platform 8.1
- Red Hat Red Hat OpenShift Dev Spaces 3.27.1

## Identifiers

- CVE-2026-33871
- GHSA-w9fj-cfpg-grvv

## Timeline

- 2026-03-24: advisory: GitHub Security Advisory published by Netty project
- 2026-03-27: disclosed: NVD publication date
- 2026-04-23: patched: Red Hat released security updates for affected products

## References

- [https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv](https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv)
- [https://access.redhat.com/errata/RHSA-2026:10175](https://access.redhat.com/errata/RHSA-2026:10175)
- [https://access.redhat.com/errata/RHSA-2026:10184](https://access.redhat.com/errata/RHSA-2026:10184)
- [https://access.redhat.com/errata/RHSA-2026:13571](https://access.redhat.com/errata/RHSA-2026:13571)
- [https://access.redhat.com/errata/RHSA-2026:14272](https://access.redhat.com/errata/RHSA-2026:14272)
- [https://access.redhat.com/errata/RHSA-2026:14276](https://access.redhat.com/errata/RHSA-2026:14276)
- [https://access.redhat.com/errata/RHSA-2026:17668](https://access.redhat.com/errata/RHSA-2026:17668)

## Related threats

- [Netty request smuggling via Host header duplication in HTTP/2 translation](https://junglewise.ai/threats/cve-2026-59900-netty-request-smuggling-via-host-header-duplication-in-http-2)
- [Netty memory leak in HTTP/2 content decompression](https://junglewise.ai/threats/cve-2026-56819-netty-memory-leak-in-http-2-content-decompression)
- [Netty denial of service in HTTP/2 codec via max header size handling](https://junglewise.ai/threats/cve-2026-50560-netty-denial-of-service-in-http-2-codec-via-max-header-size)
- [Netty memory exhaustion in DelegatingDecompressorFrameListener](https://junglewise.ai/threats/cve-2026-48043-netty-memory-exhaustion-in-delegatingdecompressorframelistener)
- [Netty uncontrolled resource consumption in HTTP/2 codec](https://junglewise.ai/threats/cve-2026-47244-netty-uncontrolled-resource-consumption-in-http-2-codec)