Executive brief
Netty is a widely used networking framework that helps Java applications handle web traffic. A security flaw allows attackers to bypass built-in protections designed to prevent 'decompression bombs'—maliciously crafted files that expand to a massive size when opened. By sending these files using specific compression formats like Brotli or Zstd, an attacker can crash the server by exhausting its memory, leading to a total service outage.
Technical details
A resource consumption vulnerability exists in Netty's HttpContentDecompressor and DelegatingDecompressorFrameListener. While the framework provides a 'maxAllocation' parameter to limit decompression buffer sizes, this limit is only enforced for gzip and deflate encodings. When an attacker specifies 'br' (Brotli), 'zstd', or 'snappy' in the Content-Encoding header, the limit is ignored, leading to unbounded memory allocation. This allows a remote, unauthenticated attacker to trigger an OutOfMemoryError (OOM) and crash the application by sending a small, highly compressed payload. The issue is resolved in versions 4.2.13.Final and 4.1.133.Final by properly passing and enforcing the allocation limits across all supported decoders.
Affected products
- Netty netty-codec-http <= 4.2.12.Final, <= 4.1.132.Final
- Netty netty-codec-http2 <= 4.2.12.Final, <= 4.1.132.Final
Timeline
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD