CVE catalog

CVE-2026-56819

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated p

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.66% · Oct 27, 2026

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannettysid1:4.1.48-16vulnerable
Debiannettyforky1:4.1.48-16vulnerable
Debiannettytrixie1:4.1.48-10+deb13u1vulnerable
Debiannettytrixie-security1:4.1.48-10+deb13u1vulnerable
Debiannettybookworm1:4.1.48-7+deb12u2vulnerable
Debiannettybookworm-security1:4.1.48-7+deb12u2vulnerable
Mavenio.netty:netty-codec-http2Not reported4.2.16.Finalfixed
Mavenio.netty:netty-codec-http2Not reported4.1.136.Finalfixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannettysourcesid(unfixed)not yet assignedNot reported[1142680]
Debiannettysourceforky(unfixed)not yet assignedNot reported[1142680]
Debiannettysourcetrixie(unfixed)not yet assignedNot reported[1142680]
Debiannettysourcebookworm(unfixed)not yet assignedNot reported[1142680]
Mavenio.netty:netty-codec-http2mavenNot reported4.2.16.FinalNot reportedNot reportedNot reported
Mavenio.netty:netty-codec-http2mavenNot reported4.1.136.FinalNot reportedNot reportedNot reported

[Debian bug #1142680]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libnetty-java]Affected

    Source package: [netty]

    Details (4)

    • 1:4.1.48-7+deb12u2 · all · bookworm

      Affected

      nvd · netty · debian · bookworm; nvd · netty · debian · 12

    • 1:4.1.48-7+deb12u2 · all · bookworm

      Affected

      nvd · netty · debian · bookworm; nvd · netty · debian · 12

    • 1:4.1.48-7+deb12u2 · all · bookworm-security

      Affected

      nvd · netty · debian · bookworm; nvd · netty · debian · 12

    • 1:4.1.48-7+deb12u2 · all · bookworm-security

      Affected

      nvd · netty · debian · bookworm; nvd · netty · debian · 12

[Debian 13 (Trixie)]

  • [libnetty-java]Affected

    Source package: [netty]

    Details (4)

    • 1:4.1.48-10+deb13u1 · all · trixie

      Affected

      nvd · netty · debian · 13

    • 1:4.1.48-10+deb13u1 · all · trixie

      Affected

      nvd · netty · debian · 13

    • 1:4.1.48-10+deb13u1 · all · trixie-security

      Affected

      nvd · netty · debian · 13

    • 1:4.1.48-10+deb13u1 · all · trixie-security

      Affected

      nvd · netty · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]