REDHAT-BUG-2505911: High severity Netty Netty vulnerability
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated SYNSTREAM frame with FLAGFIN=0 and stores the partially constructed FullHttpRequest in messageMap; when the remote peer sends RSTSTREAM for that stream or the accumulated content exceeds maxContentLength, the decoder removes the entry but does not release the pooled ByteBuf, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netty SPDY-to-HTTP codec (SpdyHttpDecoder)to a version that resolves this vulnerability.Fixed in 4.1.136.Final - Upgrade
Upgrade
Netty SPDY-to-HTTP codec (SpdyHttpDecoder)to a version that resolves this vulnerability.Fixed in 4.2.16.Final
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2505911?
The severity of REDHAT-BUG-2505911 is high, rated at 7 on the CVSS scale.
How do I fix REDHAT-BUG-2505911?
To fix REDHAT-BUG-2505911, update Netty to a version that is not affected, specifically versions above 4.2.15.Final and 4.1.135.Final.
What software is affected by REDHAT-BUG-2505911?
The affected software includes Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final.
What is the nature of the vulnerability in REDHAT-BUG-2505911?
REDHAT-BUG-2505911 involves a vulnerability in the `SpdyHttpDecoder` handler of Netty's SPDY-to-HTTP codec that allocates a pooled `ByteBuf` on handling client requests.
When was REDHAT-BUG-2505911 published?
REDHAT-BUG-2505911 was published on July 21, 2026.