CVE-2026-56819

Description

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Traduire en français

Produits concernés

• netty
• Netty netty

Scores CVSS

Faiblesses (CWE)

• CWE-400
• CWE-401

Références

• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b Patch
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 Patch
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final Release Notes
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final Release Notes
• https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972 ExploitVendor Advisory
• https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972 ExploitVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories