CVE-2026-56745: Netty SPDY Decoder DoS Vulnerability

CVE-2026-56745 Overview

CVE-2026-56745 is a memory leak vulnerability in Netty, a widely deployed network application framework used to build protocol servers and clients on the Java Virtual Machine. The flaw affects the SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec. When the decoder processes a client-initiated SYN_STREAM frame with FLAG_FIN=0, it allocates a pooled ByteBuf and stores a partially constructed FullHttpRequest in messageMap. If the remote peer subsequently sends RST_STREAM or the accumulated content exceeds maxContentLength, the entry is removed without releasing the pooled buffer. Remote attackers can trigger this path repeatedly to exhaust native memory. The issue is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated remote attackers can trigger native memory exhaustion in any Netty-based service exposing the SPDY-to-HTTP codec, causing denial of service without any user interaction.

Affected Products

Netty versions 4.2.0.Final through 4.2.15.Final
Netty versions 4.1.0.Final through 4.1.135.Final
Applications embedding the Netty SPDY-to-HTTP codec (SpdyHttpDecoder)

Discovery Timeline

2026-07-21 - CVE-2026-56745 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-56745

Vulnerability Analysis

The vulnerability resides in Netty's SPDY-to-HTTP translation layer, specifically in SpdyHttpDecoder. The decoder aggregates incoming SPDY frames into a FullHttpRequest by allocating a pooled ByteBuf and buffering data until the stream is complete. Streams are tracked in an internal messageMap keyed by stream identifier.

When a peer initiates a stream with SYN_STREAM and FLAG_FIN=0, the decoder creates the buffer and registers the pending request. If the peer then aborts the stream via RST_STREAM, or if the accumulated payload exceeds maxContentLength, the decoder removes the entry from messageMap. This teardown path does not invoke release() on the pooled buffer, so the native memory backing the buffer is never returned to Netty's allocator.

Each abandoned request permanently pins a chunk of pooled native memory. An attacker who repeatedly opens SPDY streams and cancels them can drive resident memory usage until the process is killed by the operating system or the JVM fails to allocate further direct buffers.

Root Cause

The root cause is a missing reference-count decrement on the pooled ByteBuf stored inside the pending FullHttpRequest. Netty's pooled allocator requires explicit release() calls to return native memory to the pool. The cleanup branches for RST_STREAM and maxContentLength violations remove the map entry but drop the buffer reference without releasing it, satisfying the classic conditions for [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

The attack is network-reachable, requires no authentication, and requires no user interaction. Any service that terminates SPDY on top of Netty and installs SpdyHttpDecoder is exposed. An attacker sends a stream of SYN_STREAM frames with FLAG_FIN=0 and immediately follows each with RST_STREAM, or transmits payloads that intentionally exceed maxContentLength. Every such interaction leaks a pooled buffer, and sustained traffic exhausts the native heap.

The upstream fixes shipped in Netty 4.1.136.Final and 4.2.16.Final. Related hardening across the codec suite is visible in the reference commits.

java

// Illustrative Netty codec hardening from the same release cycle
// Source: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
crc.updateCRC(nextByte);
} else {
    if (++rleAccumulator == 4) {
        if (bwtBytesDecoded >= bwtBlockLength) {
            throw new DecompressionException("malformed RLE: run-length byte missing at end of block");
        }
        // Accumulation complete, start repetition
        int rleRepeat = decodeNextBWTByte() + 1;
        this.rleRepeat = rleRepeat;

Source: Netty commit 5b68c61

Detection Methods for CVE-2026-56745

Indicators of Compromise

Sustained growth of JVM native (off-heap) memory in Netty-based services with no correlated growth in on-heap allocations.
High volume of SPDY SYN_STREAM frames with FLAG_FIN=0 immediately followed by RST_STREAM from the same peer.
Repeated log entries indicating requests rejected for exceeding maxContentLength on SPDY endpoints.
OutOfMemoryError: Direct buffer memory or OS-level OOM kills targeting Netty processes.

Detection Strategies

Inspect deployed dependencies for netty-codec-http versions in the affected ranges using SCA tooling or mvn dependency:tree / gradle dependencies.
Enable Netty's leak detector at PARANOID level (-Dio.netty.leakDetectionLevel=paranoid) in non-production environments to surface unreleased pooled buffers.
Correlate application-tier memory metrics with network telemetry showing bursts of SPDY stream resets from single sources.

Monitoring Recommendations

Instrument PooledByteBufAllocator metrics (usedDirectMemory, numActiveAllocations) via JMX and alert on unbounded growth.
Monitor rate of RST_STREAM frames per client and rate of maxContentLength violations at the SPDY endpoint.
Track process RSS versus JVM heap size to catch native memory exhaustion before OOM kills.

How to Mitigate CVE-2026-56745

Immediate Actions Required

Upgrade Netty to 4.1.136.Final or 4.2.16.Final as documented in the GitHub Security Advisory GHSA-jppx-w49h-x2qq.
Inventory all services and shaded/embedded libraries that ship Netty; container images and fat JARs frequently bundle vulnerable versions.
Rate-limit or terminate SPDY traffic at an upstream proxy until patched builds are deployed.
Restart Netty-based services showing abnormal native memory growth to reclaim leaked buffers.

Patch Information

The fix is available in Netty 4.1.136.Final and 4.2.16.Final. The corrective commits ensure that pooled ByteBuf instances associated with pending FullHttpRequest objects are released when RST_STREAM is received or when maxContentLength is exceeded. See the Netty commit history for related codec hardening.

Workarounds

Remove SpdyFrameCodec and SpdyHttpDecoder from the Netty pipeline if SPDY is not a required protocol.
Terminate TLS/HTTP at a front-end proxy that does not negotiate SPDY, forcing clients to HTTP/1.1 or HTTP/2.
Reduce maxContentLength combined with strict per-connection stream limits to shrink the leak amplification factor while patching is scheduled.

bash

# Verify installed Netty version in a Maven-based project
mvn dependency:tree | grep -E 'netty-(codec-http|all|handler)'

# Verify installed Netty version in a Gradle-based project
./gradlew dependencies --configuration runtimeClasspath | grep netty

# Enforce a fixed version via Maven dependencyManagement
# <dependency>
#   <groupId>io.netty</groupId>
#   <artifactId>netty-all</artifactId>
#   <version>4.1.136.Final</version>
# </dependency>