CVE-2026-55831 Overview
CVE-2026-55831 is a resource exhaustion vulnerability [CWE-400] in Netty, a widely deployed asynchronous network application framework for Java. The flaw resides in the SPDY SETTINGS frame decoder, which accepts a peer-declared entry count up to the 24-bit frame-length ceiling. A remote SPDY/3.1 peer can transmit a syntactically valid SETTINGS frame of roughly 2 MiB that forces DefaultSpdySettingsFrame to materialize 262,144 unique map entries. This amplifies network input into significant heap growth and ordered-map insertion work on the target. Netty versions prior to 4.1.136.Final and 4.2.16.Final are affected. The issue is resolved in 4.1.136.Final and 4.2.16.Final.
Critical Impact
Unauthenticated remote attackers can trigger heap and CPU exhaustion on Netty-based SPDY servers by sending a single crafted SETTINGS frame, resulting in denial of service.
Affected Products
- Netty versions prior to 4.1.136.Final (4.1.x branch)
- Netty versions prior to 4.2.16.Final (4.2.x branch)
- Applications and servers using Netty's SPDY/3.1 codec (io.netty.handler.codec.spdy)
Discovery Timeline
- 2026-07-21 - CVE-2026-55831 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-55831
Vulnerability Analysis
The vulnerability lives in Netty's SPDY codec, specifically in how the SETTINGS frame decoder handles the entry count field declared by the peer. SPDY SETTINGS frames carry an arbitrary number of key/value entries, each identifying a protocol parameter. Netty trusts the peer-supplied count and iterates up to the 24-bit frame-length maximum without enforcing an application-level cap.
For every unique setting identifier parsed, the decoder inserts an entry into the DefaultSpdySettingsFrame backing map. Because this map preserves ordering, each insertion incurs both allocation and tree/link maintenance cost. A single SETTINGS frame near 2 MiB yields 262,144 map entries per frame, and an attacker can pipeline multiple frames to compound heap pressure.
Root Cause
The root cause is missing input validation on the SETTINGS entry count. The decoder derives the number of entries from an attacker-controlled field and bounds it only by the frame-length ceiling, not by a protocol-sensible maximum. This is a classic uncontrolled resource consumption pattern [CWE-400], where syntactic validity of the input does not imply semantic safety.
Attack Vector
The attack requires network reachability to a Netty-based SPDY/3.1 endpoint and no authentication or user interaction. An attacker establishes a SPDY session and transmits a crafted SETTINGS frame declaring hundreds of thousands of unique setting IDs. The server allocates map entries proportional to the declared count, causing sustained heap growth, garbage collector pressure, and ordered-map insertion overhead. Repeated frames or parallel connections escalate the condition into a denial-of-service outage against the JVM.
No public proof-of-concept exploit is listed in the enriched data. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-6jqx-86gh-f27w.
Detection Methods for CVE-2026-55831
Indicators of Compromise
- Sustained JVM heap growth on Netty listeners handling SPDY traffic, followed by OutOfMemoryError or long garbage collection pauses.
- Inbound SPDY SETTINGS frames approaching the 24-bit length ceiling (near 2 MiB) from a single peer.
- Unusual spikes in DefaultSpdySettingsFrame allocations visible in JVM heap dumps or async-profiler output.
Detection Strategies
- Inspect network telemetry for SPDY/3.1 frame type 0x04 (SETTINGS) exceeding a sensible size threshold, for example 4 KiB.
- Correlate application-level errors (OutOfMemoryError, GC overhead limit exceeded) with concurrent inbound SPDY sessions.
- Enumerate Java dependencies across the estate to identify hosts running Netty versions prior to 4.1.136.Final or 4.2.16.Final with the SPDY codec on the classpath.
Monitoring Recommendations
- Alert on abnormal per-connection byte counts on ports serving SPDY, particularly during connection setup.
- Monitor JVM metrics including old-generation heap usage, GC frequency, and allocation rate on Netty-backed services.
- Track process restarts and health-check failures on services exposing SPDY endpoints for early detection of resource exhaustion.
How to Mitigate CVE-2026-55831
Immediate Actions Required
- Upgrade Netty to 4.1.136.Final or 4.2.16.Final on all affected services and rebuild dependent artifacts.
- Audit the classpath of Java services to confirm no shaded or transitive copy of a vulnerable Netty version remains.
- If SPDY is not required, remove the SPDY codec handlers from the Netty pipeline to eliminate the attack surface.
Patch Information
The fix is delivered in Netty 4.1.136.Final and 4.2.16.Final. The corrective changes are captured in commits 5b68c61 and bb2ff68, which enforce an upper bound on the SETTINGS entry count during SPDY frame decoding. Full details are published in the Netty GHSA-6jqx-86gh-f27w advisory.
Workarounds
- Terminate SPDY at an upstream proxy or load balancer that enforces frame size limits and does not forward oversized SETTINGS frames.
- Restrict inbound SPDY connectivity to trusted networks using firewall or service mesh policy until patching is complete.
- Lower the maximum SPDY frame size accepted by the pipeline via a custom decoder wrapper that rejects SETTINGS frames above a conservative threshold.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
