Executive brief
A vulnerability in the Netty networking library allows a remote attacker to crash or slow down a server by sending specially crafted SPDY web traffic. The issue occurs because the system continues to process and expand compressed data even after it has detected that the data exceeds safety limits. This can lead to a denial-of-service (DoS) condition, impacting the availability of applications that rely on Netty for handling web communications.
Technical details
A resource exhaustion vulnerability exists in Netty's SpdyFrameCodec due to improper handling of zlib-compressed header blocks. When a SPDY HEADERS frame is received, the decoder continues to inflate the compressed block even after the raw header parser has triggered a 'truncated' state by exceeding the maxHeaderSize limit. An unauthenticated remote attacker can exploit this by sending a small, highly compressed payload that expands into a much larger raw header field (e.g., 12KB expanding to 12MB). This bypasses the intended size guards, causing excessive CPU usage and memory allocation churn. The vulnerability is patched in versions 4.1.136.Final and 4.2.16.Final.
Affected products
- Netty netty-codec-http >= 4.1.0.Final, <= 4.1.135.Final
- Netty netty-codec-http >= 4.2.0.Final, <= 4.2.15.Final
Timeline
- 2026-07-14: disclosed
- 2026-07-21: advisory: NVD publication date
- 2026-07-22: patched: GitHub Advisory published and reviewed