CVE-2026-56745

Summary

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

Severity

high

EPSS

0.6% (p50)

CWE

CWE-400

Also known as

GHSA-jppx-w49h-x2qq

Published

2026-07-22

Updated

2026-07-22

Advisory details

The SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated SYN_STREAM frame with FLAG_FIN=0, storing the partially-constructed FullHttpRequest in an internal map (messageMap) to accumulate subsequent DATA frames. When the remote peer sends an RST_STREAM for that stream, or when the accumulated content exceeds maxContentLength, the decoder removes the entry from the map but never releases the pooled ByteBuf, permanently leaking the allocated memory.

References

• https://github.com/advisories/GHSA-jppx-w49h-x2qq
• https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq
• https://nvd.nist.gov/vuln/detail/CVE-2026-56745
• https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
• https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
• https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
• https://github.com/netty/netty/releases/tag/netty-4.2.16.Final

Related advisories

• CVE-2026-59903 — medium · Maven/io.netty:netty-codec-http
• CVE-2026-55247 — critical · PyPI/plone.app.event
• CVE-2026-55248 — critical · PyPI/plone.app.portlets
• GHSA-68r5-9hpg-7qw9 — critical · Maven/org.openidentityplatform.opendj:opendj-dsml-servlet
• GHSA-f2hq-32vh-53cc — high · npm/postal-mime
• CVE-2026-114055 — high · PyPI/vllm
• CVE-2026-115572 — high · PyPI/pypdf
• CVE-2026-115585 — high · PyPI/pypdf

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity