netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec

🗓️ 10 Sep 2026 23:22:22Reported by RedHatType

redhat🔗 access.redhat.com👁 12 Views

Native memory exhaustion DoS in Netty SPDY-to-HTTP codec SpdyHttpDecoder via SYN_STREAM frame.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.135.Final.jar	15 Sep 202620:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	30 Jul 202606:03	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	10 Sep 202621:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty and open62541	7 Aug 202613:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in netty-codec, spring-webflux, spring-data, Spring MVC, Immutable and ACE might affect IBM Storage Defender Copy Data Management	30 Sep 202617:08	–	ibm
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http Dependency in Bamboo Data Center	7 Aug 202616:32	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http Dependency in Confluence Data Center	2 Sep 202608:31	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http Dependency in Crowd Data Center	1 Aug 202604:31	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http Dependency in Jira Service Management Data Center	6 Aug 202616:32	–	atlassian

Vulners

Node

AND

redhat amq_brokerRange<7.13

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-56745
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
github	www.github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
github	www.github.com/netty/netty/releases/tag/netty-4.1.136.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56745
cve	www.cve.org/CVERecord

02 Oct 2026 17:35Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 48.7

EPSS0.0063

Netty SPDY-to-HTTP codec memory exhaustion denial of service SpdyHttpDecoder SYN_STREAM frame