CVE-2026-56816

HIGH 7.5

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

CWE	CWE-400
Vendor	netty
Product	netty
Published	Jul 21, 2026

Stay Ahead of the Next One

Get instant alerts for netty netty

Be the first to know when new high vulnerabilities affecting netty netty are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

netty / netty

< 4.2.16.Final

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv github.com: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b github.com: https://github.com/netty/netty/releases/tag/netty-4.2.16.Final