CVE-2026-56745: Netty memory leak in SpdyHttpDecoder leading to DoS

CVE-2026-56745 · Severity: high · CVSS 4 · Published 2026-07-21

Netty is a popular networking framework used by many Java-based applications to handle web traffic. A flaw in its SPDY protocol component allows a remote attacker to cause the application to leak memory by sending specific sequences of network messages. Over time, this memory leak can exhaust the server's available resources, leading to a complete service outage or application crash.

Technologies: io.netty:netty-codec-http (Maven), Netty Project Codec HTTP. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-56745 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56745 being exploited in the wild.
How severe is CVE-2026-56745?
High severity, with a CVSS score of 4, published 21 July 2026.
Which products and versions are affected?
io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.16.Final.
Is there a fix for CVE-2026-56745?
Yes. io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56745 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56745?
Check whether you run io.netty:netty-codec-http (Maven) or Netty Project Codec HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-http (Maven): upgrade to 4.2.16.Final or later
    # set io.netty:netty-codec-http to 4.2.16.Final in your pom.xml or build.gradle

Technical details

A memory leak exists in the SpdyHttpDecoder handler within Netty's SPDY-to-HTTP codec. When processing a client-initiated SYN_STREAM frame with FLAG_FIN=0, the decoder allocates a pooled ByteBuf and stores a partially-constructed FullHttpRequest in an internal messageMap. If the remote peer subsequently sends an RST_STREAM frame or if the accumulated content exceeds the maxContentLength, the decoder removes the entry from the map but fails to call release() on the pooled ByteBuf. This results in a permanent leak of native memory. An unauthenticated remote attacker can exploit this by repeatedly initiating and then resetting streams, eventually causing an OutOfMemoryError (OOME) and denial of service. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected products

  • Netty netty-codec-http >= 4.1.0.Final, <= 4.1.135.Final
  • Netty netty-codec-http >= 4.2.0.Final, <= 4.2.15.Final

Identifiers

  • CVE-2026-56745
  • GHSA-jppx-w49h-x2qq

Timeline

  • 2026-07-14: disclosed: Advisory published by maintainers
  • 2026-07-21: advisory: NVD published CVE-2026-56745
  • 2026-07-22: patched: GitHub Advisory Database entry finalized

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.