Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

🗓️ 22 Jul 2026 21:23:05Reported by GitHub Advisory DatabaseType

Netty spdy zlib header decoding inflates after maxHeaderSize truncation, enabling remote denial of service.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.135.Final.jar	15 Sep 202620:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	30 Jul 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	19 Aug 202618:05	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	29 Sep 202614:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	10 Sep 202621:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty and open62541	7 Aug 202613:04	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	13 Aug 202607:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in netty-codec-http,spring-core,brace-expandsion,netty-transport,log4j-core,spring-expression,js-cookie,spring-security,spring-cloud,spring-boot,spring-hateoas might affect IBM Storage Defender Copy Data Management	30 Sep 202617:06	–	ibm
attackerkb	CVE-2026-55833	20 Jul 202623:18	–	attackerkb

Vulners

Node

io.netty netty-codec-httpRange4.1.0.Final–4.1.135.Finalmaven

io.netty netty-codec-httpRange4.2.0.Final–4.2.15.Finalmaven

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-55833
github	www.github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
github	www.github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
github	www.github.com/netty/netty/releases/tag/netty-4.1.136.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/advisories/GHSA-mvh2-crg5-v77c

22 Jul 2026 21:23Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.00665

SSVC

CWE-400