Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| netty | netty | >= 4.2.0.Final, < 4.2.16.Final; >= 4.1.0.Final, < 4.1.136.Final |
References
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bPatch
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6Patch
- https://github.com/netty/netty/releases/tag/netty-4.1.136.FinalRelease Notes
- https://github.com/netty/netty/releases/tag/netty-4.2.16.FinalRelease Notes
- https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972Exploit, Vendor Advisory
- https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972Exploit, Vendor Advisory
Timeline
- Published
- Jul 21, 2026
- Last modified
- Jul 30, 2026
- NVD status
- Analyzed