CVE-2026-56819

Name of the Vulnerable Software and Affected Versions Netty versions 4.1.0.Final through 4.1.135.Final Netty versions 4.2.0.Final through 4.2.15.Final

Description A remote unauthenticated peer can cause a memory leak of one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression using DelegatingDecompressorFrameListener. The issue occurs when a DATA frame is processed for a stream with a closed decompressor; the Http2Decompressor.decompress() function calls decompressor.writeInbound(data.retain()) but fails to release the retained buffer during the error path. This leads to the exhaustion of direct memory and causes the JVM to crash.

Recommendations Update to version 4.1.136.Final Update to version 4.2.16.Final