io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak

🗓️ 21 Sep 2026 12:19:52Reported by RedHatType

redhat🔗 access.redhat.com👁 2 Views

Unauthenticated remote DoS in Netty netty-codec-http2 via HTTP/2 DATA frame memory leak.

Reporter	Title	Published	Views	Family All 496
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.135.Final.jar	15 Sep 202620:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	19 Aug 202618:05	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	10 Sep 202621:09	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	3 Sep 202616:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)	5 Aug 202613:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)	8 Sep 202614:32	–	ibm
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Bamboo Data Center	7 Aug 202616:31	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Bitbucket Data Center	11 Aug 202611:30	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Confluence Data Center	2 Sep 202607:31	–	atlassian

Vulners

Node

AND

redhat jboss_data_gridRange<8

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-56819
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
github	www.github.com/netty/netty/releases/tag/netty-4.1.136.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.16.Final
github	www.github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-56819
cve	www.cve.org/CVERecord

23 Sep 2026 17:47Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.00443

SSVC

io.netty/netty-codec-http2 Netty Denial of Service HTTP/2 DATA frame memory leak HTTP/2 content decompression