CVE-2026-56819: Netty HTTP/2 DoS Vulnerability

CVE-2026-56819 Overview

CVE-2026-56819 is a memory leak vulnerability in Netty, a network application framework for building protocol servers and clients in the JVM. The flaw affects applications that enable HTTP/2 content decompression through DelegatingDecompressorFrameListener. A remote unauthenticated attacker can leak one direct ByteBuf per HTTP/2 DATA frame sent to a stream whose decompressor has already been closed. Repeated frames exhaust direct memory and crash the Java Virtual Machine (JVM). The issue is categorized as an uncontrolled resource consumption weakness [CWE-400] and is fixed in Netty 4.1.136.Final and 4.2.16.Final.

Critical Impact
Unauthenticated remote attackers can crash Netty-based HTTP/2 servers by triggering direct memory exhaustion, resulting in denial of service for any application built on affected Netty releases.

Affected Products

Netty versions 4.2.0.Final through 4.2.15.Final
Netty versions 4.1.0.Final through 4.1.135.Final
Any JVM application using DelegatingDecompressorFrameListener for HTTP/2 decompression

Discovery Timeline

2026-07-21 - CVE-2026-56819 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-56819

Vulnerability Analysis

The defect lives in Netty's HTTP/2 decompression path. When an HTTP/2 DATA frame arrives for a stream, Http2Decompressor.decompress(...) retains the incoming buffer and forwards it to the per-stream decompressor with decompressor.writeInbound(data.retain()). If the decompressor has already been closed for that stream, the retained buffer is not released on the error path. Each affected frame leaks one direct ByteBuf. Because Netty allocates decompression buffers from the direct memory pool, an attacker can drive the JVM toward OutOfMemoryError: Direct buffer memory and crash the process.

Exploitation requires no authentication and no user interaction. The attacker simply needs network access to an HTTP/2 endpoint that enables content decompression. The attack scales linearly with frame volume, making it practical over a single HTTP/2 connection.

Root Cause

The root cause is missing buffer release in an error branch. data.retain() increments the reference count of the direct ByteBuf before delivering it to the closed decompressor. The subsequent failure path exits without a corresponding release(), breaking Netty's reference-counted lifecycle contract and leaking the buffer. See the fix commits 5b68c61f37aa4a3045cba624cbea239655c9003b and bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 on the Netty GitHub repository for the exact code changes.

Attack Vector

A remote attacker opens an HTTP/2 connection to a vulnerable server that enables content decompression. The attacker sends DATA frames on a stream whose decompressor state has transitioned to closed. Each such frame consumes and leaks one direct buffer. Sustained traffic exhausts the JVM's direct memory region and terminates the process, producing a denial-of-service condition. The realCodeExamples referenced in the associated pull request touch adjacent hardening in Netty's DNS and Bzip2 decoders and are not shown here; the HTTP/2 fix is available in the linked commits.

Detection Methods for CVE-2026-56819

Indicators of Compromise

Repeated java.lang.OutOfMemoryError: Direct buffer memory entries in JVM logs preceding process termination
Steadily rising io.netty.util.internal.PlatformDependent.usedDirectMemory() metrics without corresponding traffic growth
HTTP/2 clients issuing large volumes of DATA frames against streams the server has already closed or reset
Unexpected JVM crashes on services fronted by Netty-based HTTP/2 listeners

Detection Strategies

Inventory JVM applications and identify Netty versions in the vulnerable ranges using software composition analysis
Instrument HTTP/2 endpoints to log frame-type counts per stream, alerting on high DATA frame rates against closed streams
Correlate direct memory growth with HTTP/2 traffic patterns in APM tooling to surface anomalous consumption

Monitoring Recommendations

Track direct buffer allocation and release counters via Netty's ResourceLeakDetector in production-safe sampling mode
Alert on JVM heap and off-heap memory saturation trends over rolling windows
Monitor process restart frequency for services exposing HTTP/2 to untrusted networks

How to Mitigate CVE-2026-56819

Immediate Actions Required

Upgrade Netty to 4.1.136.Final or 4.2.16.Final in all affected applications and rebuild dependent artifacts
Identify transitive Netty dependencies pulled in by frameworks such as gRPC, Vert.x, Reactor Netty, and Armeria, and pin them to fixed versions
Restart JVM processes after upgrade to ensure the patched decompression path is loaded

Patch Information

The fix is delivered in Netty 4.1.136.Final and Netty 4.2.16.Final. The vendor advisory GHSA-93wv-jw9v-4972 documents the affected ranges and remediation.

Workarounds

Disable HTTP/2 content decompression by removing DelegatingDecompressorFrameListener from the pipeline where feasible
Place a hardened HTTP/2 aware reverse proxy in front of Netty services to terminate and re-originate HTTP/2, breaking the direct client attack path
Apply strict rate limits on HTTP/2 DATA frames per connection and enforce short idle timeouts on untrusted clients

bash

# Maven dependency override enforcing the patched Netty release
mvn versions:use-dep-version -Dincludes=io.netty:* -DdepVersion=4.1.136.Final -DforceVersion=true

# Gradle constraint enforcing the patched Netty release
# build.gradle
# dependencies {
#   constraints {
#     implementation('io.netty:netty-all:4.1.136.Final') { because 'CVE-2026-56819' }
#   }
# }