CVE-2026-56816

HighCVSS 7.5/10Last modified Aug 7, 2026

Description

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
netty	netty	< 4.2.16.Final

References

https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bPatch
https://github.com/netty/netty/releases/tag/netty-4.2.16.FinalRelease Notes
https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fvExploit, Vendor Advisory

Timeline

Published: Jul 21, 2026
Last modified: Aug 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-568179.8Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4 CVE-2026-568186.5Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redi CVE-2026-568197.5Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4 CVE-2026-56823.7A vulnerability has been found in Meesho Online Shopping App up to 27.3 on Android. Affected is an unknown function of the file /api/endpoin CVE-2026-568209.1Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and p CVE-2026-568217.4Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertif CVE-2026-568227.4Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertif CVE-2026-568235.4AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the `P CVE-2026-568258.1Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php expos CVE-2026-568265.4Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only acces CVE-2026-568278.1Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, CVE-2026-568288.8Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps afte