Executive brief
Netty, a widely used networking framework for Java applications, contains a flaw in its Linux-specific networking component. An attacker can send specially timed network signals to cause the server to stop cleaning up old connections or enter a state of 100% CPU usage. This can lead to a complete service outage by exhausting system resources or making the server unresponsive to legitimate users.
Technical details
A vulnerability exists in Netty's epoll transport when ALLOW_HALF_CLOSURE is enabled or when using the HTTP codec. If a remote peer sends a FIN followed by a RST (e.g., via SO_LINGER=0), the server-side channel fails to close because epollInReady() short-circuits and the EPOLLERR/EPOLLHUP conditions are never processed. This leads to resource exhaustion via stale file descriptors or a CPU busy-loop if clearEpollIn0() is not called, starving other multiplexed connections. The issue is fixed in version 4.2.13.Final by ensuring proper error condition processing during half-closure states.
Affected products
- Netty netty-transport-classes-epoll >= 4.2.0.Final, < 4.2.13.Final
Timeline
- 2026-04-25: other: Fix merged into 4.2 branch
- 2026-05-05: disclosed
- 2026-05-06: advisory