CVE-2026-56745

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.135.Final Netty versions 4.2.0.Final through 4.2.15.Final

Description The SpdyHttpDecoder handler in the SPDY-to-HTTP codec allocates a pooled ByteBuf when processing a client-initiated SYN STREAM frame where FLAG FIN is 0, storing the partially constructed FullHttpRequest in messageMap. If the remote peer sends a RST STREAM for that stream or the accumulated content exceeds maxContentLength, the decoder removes the entry without releasing the pooled ByteBuf, leading to native memory exhaustion.

Recommendations Update to version 4.1.136.Final Update to version 4.2.16.Final