Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

🗓️ 31 Jul 2026 16:51:50Reported by GitHub Advisory DatabaseType

Unauthenticated peers leak direct ByteBuf on HTTP/2 data after decompressor closes, causing DoS.

Reporter	Title	Published	Views	Family All 25
BDU FSTEC	Уязвимость механизма декомпрессии Http2Decompressor.decompress фреймворка для разработки сетевых приложений, серверов и клиентов протоколов Netty, позволяющая нарушителю вызвать отказ в обслуживании	27 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-56819	22 Jul 202601:00	–	circl
CVE	CVE-2026-56819	21 Jul 202622:11	–	cve
Cvelist	CVE-2026-56819 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)	21 Jul 202622:11	–	cvelist
Debian CVE	CVE-2026-56819	21 Jul 202622:11	–	debiancve
EUVD	EUVD-2026-47581	31 Jul 202616:51	–	euvd
NVD	CVE-2026-56819	21 Jul 202623:17	–	nvd
OSV	CVE-2026-56819 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)	21 Jul 202622:11	–	osv
OSV	DEBIAN-CVE-2026-56819	21 Jul 202623:17	–	osv
OSV	GHSA-93WV-JW9V-4972 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)	31 Jul 202616:51	–	osv

Vulners

Node

io.netty netty-codec-http2Range4.1.0.Final–4.1.135.Finalmaven

io.netty netty-codec-http2Range4.2.0–4.2.15.Finalmaven

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56819
github	www.github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
github	www.github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
github	www.github.com/netty/netty/releases/tag/netty-4.1.136.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/advisories/GHSA-93wv-jw9v-4972

31 Jul 2026 16:51Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.17.5

EPSS0.00365

SSVC