Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS

🗓️ 07 May 2026 00:46:35Reported by GitHub Advisory DatabaseType

HttpContentDecompressor fails to cap Brotli, Zstandard, and Snappy decompression, enabling denial of service.

Reporter	Title	Published	Views	Family All 194
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains vulnerabilities related to use of netty-codec-http	19 May 202619:19	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Netty IBM webMethods Managed File Transfer is vulnerable to Improper Access Control and Allocation of Resources without Limits or Throttling	6 Aug 202613:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	25 Jun 202617:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is affected by multiple vulnerability in the netty-codec-http library that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests(CVE-2026-42581, CVE-2026-42584).	31 Jul 202620:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty	21 May 202616:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	23 Jun 202619:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:27	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Netty, IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	11 Jun 202607:12	–	ibm
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Bamboo Data Center	1 Jun 202622:29	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Crowd Data Center	12 Jun 202611:29	–	atlassian

Vulners

Node

io.netty netty-codec-http2Range≤4.1.132.Finalmaven

io.netty netty-codec-httpRange≤4.1.132.Finalmaven

io.netty netty-codec-http2Range4.2.0.Alpha1–4.2.12.Finalmaven

io.netty netty-codec-httpRange4.2.0.Alpha1–4.2.12.Finalmaven

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42587
github	www.github.com/advisories/GHSA-f6hv-jmp6-3vwv

14 May 2026 20:41Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.0099

SSVC

CWE-400