# CVE-2026-55833: Netty resource exhaustion in SPDY header decoding

Source: https://junglewise.ai/threats/cve-2026-55833-netty-resource-exhaustion-in-spdy-header-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-55833 · Severity: high · CVSS 7.5 · Published 2026-07-21

A vulnerability in the Netty networking library allows a remote attacker to crash or slow down a server by sending specially crafted SPDY web traffic. The issue occurs because the system continues to process and expand compressed data even after it has detected that the data exceeds safety limits. This can lead to a denial-of-service (DoS) condition, impacting the availability of applications that rely on Netty for handling web communications.

Technologies: [io.netty:netty-codec-http (Maven)](https://junglewise.ai/threats/technologies/io-netty-netty-codec-http), [Netty Project Codec HTTP](https://junglewise.ai/threats/technologies/codec-http). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty Project](https://junglewise.ai/threats/vendors/netty-project).

## Quick answers

**Is CVE-2026-55833 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55833 being exploited in the wild.

**How severe is CVE-2026-55833?** High severity, with a CVSS score of 7.5, published 21 July 2026.

**Which products and versions are affected?** io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.

**Is there a fix for CVE-2026-55833?** Yes. io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55833 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55833?** Check whether you run io.netty:netty-codec-http (Maven) or Netty Project Codec HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later

  ```sh
  # set io.netty:netty-codec-http to 4.2.16.Final in your pom.xml or build.gradle
  ```


## Technical details

A resource exhaustion vulnerability exists in Netty's SpdyFrameCodec due to improper handling of zlib-compressed header blocks. When a SPDY HEADERS frame is received, the decoder continues to inflate the compressed block even after the raw header parser has triggered a 'truncated' state by exceeding the maxHeaderSize limit. An unauthenticated remote attacker can exploit this by sending a small, highly compressed payload that expands into a much larger raw header field (e.g., 12KB expanding to 12MB). This bypasses the intended size guards, causing excessive CPU usage and memory allocation churn. The vulnerability is patched in versions 4.1.136.Final and 4.2.16.Final.

## Affected products

- Netty netty-codec-http >= 4.1.0.Final, <= 4.1.135.Final
- Netty netty-codec-http >= 4.2.0.Final, <= 4.2.15.Final

## Identifiers

- CVE-2026-55833
- GHSA-mvh2-crg5-v77c

## Timeline

- 2026-07-14: disclosed
- 2026-07-21: advisory: NVD publication date
- 2026-07-22: patched: GitHub Advisory published and reviewed

## References

- [https://api.github.com/users/Alexender676](https://api.github.com/users/Alexender676)
- [https://github.com/Alexender676](https://github.com/Alexender676)
- [https://api.github.com/users/Alexender676/gists%7B/gist_id%7D](https://api.github.com/users/Alexender676/gists%7B/gist_id%7D)
- [https://api.github.com/users/Alexender676/repos](https://api.github.com/users/Alexender676/repos)
- [https://avatars.githubusercontent.com/u/287557165?v=4](https://avatars.githubusercontent.com/u/287557165?v=4)
- [https://api.github.com/users/Alexender676/events%7B/privacy%7D](https://api.github.com/users/Alexender676/events%7B/privacy%7D)

## Related threats

- [Netty CorsHandler cache poisoning via Vary header overwrite](https://junglewise.ai/threats/cve-2026-59903-netty-corshandler-cache-poisoning-via-vary-header-overwrite)
- [Netty HTTP request smuggling via lax WebSocket handshake validation](https://junglewise.ai/threats/cve-2026-59898-netty-http-request-smuggling-via-lax-websocket-handshake)
- [Netty resource exhaustion in HttpContentEncoder via HTTP pipelining](https://junglewise.ai/threats/cve-2026-59899-netty-resource-exhaustion-in-httpcontentencoder-via-http)
- [Netty CRLF injection in HttpPostRequestEncoder multipart filenames](https://junglewise.ai/threats/cve-2026-59921-netty-crlf-injection-in-httppostrequestencoder-multipart)
- [Netty security bypass in CorsHandler origin evaluation](https://junglewise.ai/threats/cve-2026-56746-netty-security-bypass-in-corshandler-origin-evaluation)