CVE-2026-55833

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final

Description An issue exists in the SPDY protocol implementation where header decoding continues inflating zlib-compressed header blocks even after the raw header parser has exceeded the maxHeaderSize and marked the frame as truncated in SpdyFrameCodec. This allows a remote attacker to send a small compressed HEADERS block that expands into significantly larger raw header data, leading to compression-amplified CPU and memory allocation churn, which can result in a denial of service.

Recommendations Update to version 4.1.136.Final or later. Update to version 4.2.16.Final or later.