Resource exhaustion in Netty - CVE-2026-56816
Published: July 15, 2026
Vulnerability identifier: #VU137570
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-56816
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Http3FrameCodec when processing HTTP/3 reserved frames. A remote attacker can send specially crafted reserved frames with large payload lengths across multiple QUIC streams to cause a denial of service.
The payload length is read directly from the wire without validation, which can lead to gradual memory exhaustion and out-of-memory conditions.
Affected software
Netty
How to mitigate CVE-2026-56816
Install security update from vendor's website.
Netty - update to 4.2.16