Skip to content
OpenAdvisories
High · 7.5 CVE-2026-42587 EUVD-2026-30130GHSA-f6hv-jmp6-3vwv

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Published May 13, 2026 · Updated Sep 18, 2026 · Assigned by GitHub_M

Vendor: io.netty Vendor: netty Product: netty Product: netty-codec-http Product: netty-codec-http2 Package: akhq Package: apache-activemq-artemis Package: apache-nifi Package: apache-nifi-registry Package: apache-pulsar-4.2 Package: apicurio-registry Package: celeborn-0.6 Package: docker-selenium-base Package: druid Package: flyway Package: infinispan-16.1 Package: io.netty:netty-codec-http Package: io.netty:netty-codec-http2 Package: keycloak-26.4-iamguarded-compat Package: keycloak-26.5 Package: keycloak-26.5-iamguarded-compat Package: keycloak-26.5-operator Package: keycloak-26.6 Package: keycloak-26.6-iamguarded-compat Package: keycloak-26.6-operator Package: kserve-modelmesh Package: logstash-9.3 Package: logstash-9.3-iamguarded-compat Package: logstash-9.3-with-output-opensearch Package: management-api-for-apache-cassandra-5.0 Package: neo4j-2025.10 Package: neo4j-2026.01 Package: netty Package: opensearch-2 Package: opensearch-3 Package: opensearch-3-discovery-ec2 Package: opensearch-3-iamguarded-compat Package: opensearch-3-ml-commons Package: opensearch-3-neural-search Package: opensearch-3-notifications Package: opensearch-3-performance-analyzer Package: opensearch-3-repository-azure Package: opensearch-3-repository-s3 Package: opensearch-3-security Package: opensearch-3-security-analytics Package: selenium-server Package: sonarqube Package: spark-4.0-scala-2.13 Package: spark-4.1-scala-2.13 Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: tez Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: trino-plugin-delta-lake Package: trino-plugin-elasticsearch Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-hive Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-lakehouse Package: trino-plugin-opensearch Package: trino-plugin-pinot Package: trino-plugin-redshift Package: trino-plugin-spooling-filesystem Package: trino-plugin-thrift Package: wavefront-proxy Package: wildfly-openjdk-17 Package: wildfly-openjdk-21 Package: zipkin Package: zipkin-slim Ecosystem: Debian Ecosystem: Maven Ecosystem: Wolfi

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected products

VendorProductAffectedFixed
netty netty >= 4.2.0.Alpha1, < 4.2.13.Final, < 4.1.133.Final —
io.netty netty-codec-http >= 4.2.0.Alpha1, < 4.2.13.Final, < 4.1.133.Final —
io.netty netty-codec-http2 >= 4.2.0.Alpha1, < 4.2.13.Final, < 4.1.133.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 netty No fix yet —
Debian 13 netty No fix yet —
Debian 12 netty No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Single Sign On 7 rh-sso7-keycloak +1 18.0.20-1.redhat_00001.1.el7sso RHSA-2026:76130, RHSA-2026:76129, RHSA-2026:76128
Red Hat Jboss Enterprise Application Platform Els 7 eap7-activemq-artemis +15 2.16.0-22.redhat_00057.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-glassfish-jsf 2.3.14-11.SP11_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-ironjacamar +8 1.5.26-2.Final_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jackson-core +10 2.18.8-1.redhat_00003.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-remoting 5.0.31-3.SP2_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-jboss-server-migration +2 1.10.0-46.Final_redhat_00044.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-netty +26 4.1.135-1.Final_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-api +7 2.5.5-24.SP12_redhat_00016.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-picketlink-bindings +1 2.5.5-30.SP12_redhat_00020.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-undertow 2.2.40-1.SP3_redhat_00001.1.el8eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly +4 7.4.25-2.GA_redhat_00001.1.el7eap RHSA-2026:53646, RHSA-2026:53645, RHSA-2026:53644
Red Hat Jboss Enterprise Application Platform Els 7 eap7-wildfly-java-jdk17 7.4.25-2.GA_redhat_00001.1.el8eap RHSA-2026:53646, RHSA-2026:53645
Red Hat JBoss EAP 8 eap8-eap-product-conf-parent +1 801.7.1-1.GA_redhat_00001.1.el8eap RHSA-2026:49700
Red Hat JBoss EAP 8 eap8-jose4j 0.9.6-2.redhat_00002.1.el8eap RHSA-2026:49700
Red Hat JBoss EAP 8 eap8-netty +14 4.1.135-1.Final_redhat_00001.1.el8eap RHSA-2026:49700
Red Hat JBoss EAP 8 eap8-wildfly +3 8.1.7.1-1.GA_redhat_00004.1.el8eap RHSA-2026:49700

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 netty 4.1.133-150200.4.46.1 SUSE-SU-2026:2308-1
SLES 15 SP7 netty-tcnative 2.0.77-150200.3.39.1 SUSE-SU-2026:2308-1
SLES 15 SP6 netty-tcnative 2.0.77-150200.3.39.1 SUSE-SU-2026:2308-1
SLES 15 SP5 netty-tcnative 2.0.77-150200.3.39.1 SUSE-SU-2026:2308-1
SLES 15 SP4 netty-tcnative 2.0.77-150200.3.39.1 SUSE-SU-2026:2308-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 netty-tcnative 2.0.77-150200.3.39.1 SUSE-SU-2026:2308-1
SLES for SAP 15 SP5 netty-tcnative 2.0.77-150200.3.39.1 SUSE-SU-2026:2308-1
SLES for SAP 15 SP4 netty-tcnative 2.0.77-150200.3.39.1 SUSE-SU-2026:2308-1
SLE HPC 15 SP5 netty-tcnative 2.0.77-150200.3.39.1 SUSE-SU-2026:2308-1
SLE HPC 15 SP4 netty-tcnative 2.0.77-150200.3.39.1 SUSE-SU-2026:2308-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed netty 4.1.133-1.1 openSUSE-SU-2026:10795-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.27.1-r1 —
Wolfi rolling apache-activemq-artemis 2.54.0-r1 —
Wolfi rolling apache-nifi 2.9.0-r6 —
Wolfi rolling apache-nifi-registry 2.9.0-r8 —
Wolfi rolling apache-pulsar-4.2 4.2.1-r2 —
Wolfi rolling apicurio-registry 3.2.1-r3 —
Wolfi rolling celeborn-0.6 0.6.3-r3 —
Wolfi rolling docker-selenium-base 4.43.0.20260404-r2 —
Wolfi rolling druid 37.0.0-r1 —
Wolfi rolling flyway 12.6.0-r0 —
Wolfi rolling infinispan-16.1 16.1.3-r2 —
Wolfi rolling keycloak-26.5 +5 No fix yet —
Wolfi rolling keycloak-26.6 +2 26.6.1-r2 —
Wolfi rolling kserve-modelmesh 0.12.0-r33 —
Wolfi rolling logstash-9.3 +1 9.3.4-r4 —
Wolfi rolling management-api-for-apache-cassandra-5.0 0.1.117-r1 —
Wolfi rolling neo4j-2026.01 2026.01.4-r1 —
Wolfi rolling opensearch-2 2.19.4-r14 —
Wolfi rolling opensearch-3 +6 3.6.0-r5 —
Wolfi rolling opensearch-3-discovery-ec2 +2 3.8.0-r3 —
Wolfi rolling opensearch-3-security-analytics 3.7.0-r0 —
Wolfi rolling selenium-server 4.44.0-r0 —
Wolfi rolling sonarqube 26.7.0.124771-r0 —
Wolfi rolling spark-4.0-scala-2.13 4.0.2-r12 —
Wolfi rolling spark-4.1-scala-2.13 4.1.2-r0 —
Wolfi rolling strimzi-kafka-operator-kafka-init +6 0.51.0-r25 —
Wolfi rolling tez 0.10.5-r12 —
Wolfi rolling thingsboard-tb-node +1 4.3.1.1-r5 —
Wolfi rolling trino-plugin-hive +12 481-r0 —
Wolfi rolling wavefront-proxy 13.9-r13 —
Wolfi rolling wildfly-openjdk-17 +1 39.0.1-r9 —
Wolfi rolling zipkin +1 3.6.1-r6 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-codec-http >= 4.2.0.Alpha1, < 4.2.13.Final 4.2.13.Final GHSA-f6hv-jmp6-3vwv
Maven io.netty:netty-codec-http < 4.1.133.Final 4.1.133.Final GHSA-f6hv-jmp6-3vwv
Maven io.netty:netty-codec-http2 >= 4.2.0.Alpha1, < 4.2.13.Final 4.2.13.Final GHSA-f6hv-jmp6-3vwv
Maven io.netty:netty-codec-http2 < 4.1.133.Final 4.1.133.Final GHSA-f6hv-jmp6-3vwv

Advisories 25

References