Is CVE-2026-55833 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55833 being exploited in the wild.

How severe is CVE-2026-55833?

High severity, with a CVSS score of 7.5, published 21 July 2026.

Which products and versions are affected?

io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.

Is there a fix for CVE-2026-55833?

Yes. io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55833 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55833?

Check whether you run io.netty:netty-codec-http (Maven) or Netty Project Codec HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55833: Netty resource exhaustion in SPDY header decoding

CVE-2026-55833 · Severity: high · CVSS 7.5 · Published 2026-07-21

A vulnerability in the Netty networking library allows a remote attacker to crash or slow down a server by sending specially crafted SPDY web traffic. The issue occurs because the system continues to process and expand compressed data even after it has detected that the data exceeds safety limits. This can lead to a denial-of-service (DoS) condition, impacting the availability of applications that rely on Netty for handling web communications.

Technologies: io.netty:netty-codec-http (Maven), Netty Project Codec HTTP. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-55833 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55833 being exploited in the wild.
How severe is CVE-2026-55833?: High severity, with a CVSS score of 7.5, published 21 July 2026.
Which products and versions are affected?: io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.
Is there a fix for CVE-2026-55833?: Yes. io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55833 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55833?: Check whether you run io.netty:netty-codec-http (Maven) or Netty Project Codec HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later

# set io.netty:netty-codec-http to 4.2.16.Final in your pom.xml or build.gradle

Technical details

A resource exhaustion vulnerability exists in Netty's SpdyFrameCodec due to improper handling of zlib-compressed header blocks. When a SPDY HEADERS frame is received, the decoder continues to inflate the compressed block even after the raw header parser has triggered a 'truncated' state by exceeding the maxHeaderSize limit. An unauthenticated remote attacker can exploit this by sending a small, highly compressed payload that expands into a much larger raw header field (e.g., 12KB expanding to 12MB). This bypasses the intended size guards, causing excessive CPU usage and memory allocation churn. The vulnerability is patched in versions 4.1.136.Final and 4.2.16.Final.

Affected products

Netty netty-codec-http >= 4.1.0.Final, <= 4.1.135.Final
Netty netty-codec-http >= 4.2.0.Final, <= 4.2.15.Final

Identifiers

CVE-2026-55833
GHSA-mvh2-crg5-v77c

Timeline

2026-07-14: disclosed
2026-07-21: advisory: NVD publication date
2026-07-22: patched: GitHub Advisory published and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.