Junglewise Threat Intelligence

CVE-2026-56819: Netty memory leak in HTTP/2 content decompression

CVE-2026-56819 · Severity: high · CVSS 7.5 · Published 2026-07-21

Technologies: Netty Project Netty Codec HTTP2. Vendors: Netty, Netty Project.

Executive brief

Netty is a popular networking library used by many Java-based web servers and applications to handle data traffic. A flaw in how it handles compressed web traffic (HTTP/2) allows a remote attacker to cause a memory leak by sending specially crafted data packets. Over time, this leak will consume all available system memory, causing the application to crash and resulting in a denial of service for legitimate users.

Technical details

A memory leak exists in DelegatingDecompressorFrameListener.java within the Http2Decompressor.decompress() method. When a DATA frame is received for a stream where the decompressor has already been closed, the code calls data.retain() before writeInbound(), incrementing the reference count. If writeInbound() throws a ClosedChannelException, the error handling path fails to call data.release(), preventing the ByteBuf from ever reaching a zero reference count. An attacker can exploit this by repeatedly sending DATA frames for closed streams over a long-lived HTTP/2 connection to exhaust direct memory. The issue is fixed in Netty versions 4.1.136.Final and 4.2.16.Final.

Affected products

  • Netty netty-codec-http2 >= 4.2.0, <= 4.2.15.Final
  • Netty netty-codec-http2 >= 4.1.0.Final, <= 4.1.135.Final

Timeline

  • 2026-07-14: disclosed
  • 2026-07-31: advisory

References

Related threats