CVE-2026-56816: Netty memory exhaustion in Http3FrameCodec

CVE-2026-56816 · Severity: high · CVSS 7.5 · Published 2026-07-21

Netty, a popular networking framework for Java applications, contains a vulnerability in its HTTP/3 implementation. An attacker can send specially crafted network traffic that forces the server to consume excessive amounts of memory. This can lead to a system crash or service outage, preventing legitimate users from accessing the application.

Technologies: io.netty:netty-codec-http3 (Maven), Netty Codec HTTP/3. Vendors: Maven, Netty.

Quick answers

Is CVE-2026-56816 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56816 being exploited in the wild.
How severe is CVE-2026-56816?
High severity, with a CVSS score of 7.5, published 21 July 2026.
Which products and versions are affected?
io.netty:netty-codec-http3 (Maven) < 4.2.16.Final, ECOSYSTEM:introduced=0,fixed=4.2.16.Final.
Is there a fix for CVE-2026-56816?
Yes. io.netty:netty-codec-http3 (Maven): upgrade to 4.2.16.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56816 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56816?
Check whether you run io.netty:netty-codec-http3 (Maven) or Netty Codec HTTP/3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-http3 (Maven): upgrade to 4.2.16.Final or later
    # set io.netty:netty-codec-http3 to 4.2.16.Final in your pom.xml or build.gradle

Technical details

An uncontrolled resource consumption vulnerability exists in Netty's Http3FrameCodec. The decodeFrame method handles HTTP/3 reserved frame types by reading the payload length directly from the wire and trusting it without validation. An unauthenticated remote attacker can send a reserved frame with a payload length up to Integer.MAX_VALUE across multiple QUIC streams. This causes the server to buffer data in memory until the specified length is reached, leading to OutOfMemory (OOM) errors and a Denial of Service (DoS). The issue is fixed in version 4.2.16.Final.

Affected products

  • Netty netty-codec-http3 < 4.2.16.Final

Identifiers

  • CVE-2026-56816
  • GHSA-hpcc-26xq-25fv

Timeline

  • 2026-07-14: patched: Fix released in version 4.2.16.Final
  • 2026-07-21: advisory: NVD publication date
  • 2026-07-22: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.