io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

🗓️ 12 Aug 2026 19:35:14Reported by RedHatType

Netty HTTP/2 DATA frame handling leaks retained buffers after decompressor closure, causing memory exhaustion and unauthenticated DoS.

Reporter	Title	Published	Views	Family All 128
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	19 Aug 202618:05	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	5 Aug 202613:18	–	ibm
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Bamboo Data Center	7 Aug 202616:31	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Bitbucket Data Center	11 Aug 202611:30	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Crowd Data Center	2 Aug 202616:30	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Jira Service Management Data Center	6 Aug 202617:30	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Jira Software Data Center	6 Aug 202616:30	–	atlassian
BDU FSTEC	Уязвимость механизма декомпрессии Http2Decompressor.decompress фреймворка для разработки сетевых приложений, серверов и клиентов протоколов Netty, позволяющая нарушителю вызвать отказ в обслуживании	27 Jul 202600:00	–	bdu_fstec
Chainguard	CVE-2026-56819 vulnerabilities	1 Aug 202620:22	–	cgr

Vulners

Node

AND

redhat amq_streamsRange<3.2el9

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-56819
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
github	www.github.com/netty/netty/releases/tag/netty-4.1.136.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56819
cve	www.cve.org/CVERecord

27 Aug 2026 20:51Current

7.2High risk

Vulners AI Score7.2

CVSS 3.17.5

EPSS0.00443

SSVC

CWE-911