REDHAT-BUG-2503103: High severity Netty Netty vulnerability
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in DefaultSpdySettingsFrame, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nettyto a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
Nettyto a version that resolves this vulnerability.Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2503103?
The severity of REDHAT-BUG-2503103 is classified as high, with a score of 7.
How do I fix REDHAT-BUG-2503103?
To fix REDHAT-BUG-2503103, update to Netty version 4.1.136.Final or 4.2.16.Final or later.
What effect does REDHAT-BUG-2503103 have on my system?
REDHAT-BUG-2503103 can allow attackers to exploit the SPDY SETTINGS decoder vulnerability in Netty.
Which versions of Netty are affected by REDHAT-BUG-2503103?
REDHAT-BUG-2503103 affects versions of Netty prior to 4.1.136.Final and 4.2.16.Final.
When was REDHAT-BUG-2503103 published?
REDHAT-BUG-2503103 was published on July 21, 2026.