CVE-2026-56745: Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated SYNSTREAM frame with FLAGFIN=0 and stores the partially constructed FullHttpRequest in messageMap; when the remote peer sends RSTSTREAM for that stream or the accumulated content exceeds maxContentLength, the decoder removes the entry but does not release the pooled ByteBuf, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Other sources
The SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated SYNSTREAM frame with FLAGFIN=0, storing the partially-constructed FullHttpRequest in an internal map (messageMap) to accumulate subsequent DATA frames. When the remote peer sends an RSTSTREAM for that stream, or when the accumulated content exceeds maxContentLength, the decoder removes the entry from the map but never releases the pooled ByteBuf, permanently leaking the allocated memory.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
maven/io.netty:netty-codec-httpto a version that resolves this vulnerability.Fixed in 4.2.16.Final - Upgrade
Upgrade
Netty SPDY-to-HTTP codec (SpdyHttpDecoder)to a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
Netty SPDY-to-HTTP codec (SpdyHttpDecoder)to a version that resolves this vulnerability.Fixed in 4.2.16.Final - Configuration
Set/adjust Netty SPDY-to-HTTP codec maxContentLength so accumulated content exceeding maxContentLength is handled (entries are removed from messageMap), reducing exposure while upgrading. (This is a mitigation; the ByteBuf leak is fixed only in 4.1.136.Final and 4.2.16.Final.)
Netty SPDY-to-HTTP codec (SpdyHttpDecoder) maxContentLength = (ensure set to a safe limit; content exceeding it triggers decoder removal)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56745?
CVE-2026-56745 has a high severity rating of 8.7 according to the CVSS scoring system.
How do I fix CVE-2026-56745?
To address CVE-2026-56745, upgrade to Netty versions 4.2.16.Final or later for 4.2.x series, and 4.1.136.Final or later for 4.1.x series.
What causes CVE-2026-56745?
CVE-2026-56745 is caused by a ByteBuf reference leak in the `SpdyHttpDecoder` handler during the processing of client-initiated RST_STREAM.
What are the consequences of not fixing CVE-2026-56745?
If CVE-2026-56745 is not mitigated, it can lead to native memory exhaustion, potentially crashing the application.
Which software versions are vulnerable to CVE-2026-56745?
Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final of Netty are vulnerable to CVE-2026-56745.