Skip to content
OpenAdvisories
High · 7.5 CVE-2026-56816 EUVD-2026-47564GHSA-hpcc-26xq-25fv

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

Published Jul 21, 2026 · Updated Jul 22, 2026 · Assigned by GitHub_M

Vendor: netty Product: netty Package: io.netty:netty-codec-http3 Package: netty Package: netty Package: opensearch-3 Package: opensearch-3-discovery-ec2 Package: opensearch-3-iamguarded-compat Package: opensearch-3-neural-search Package: opensearch-3-repository-azure Package: opensearch-3-security Package: spark-4.1-scala-2.13 Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

Affected products

VendorProductAffectedFixed
netty netty < 4.2.16.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 netty No fix yet —
Debian 13 netty No fix yet —
Debian 12 netty No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netty No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS netty No fix yet —
Ubuntu Pro 24.04 LTS netty No fix yet —
Ubuntu Pro 22.04 LTS netty No fix yet —
Ubuntu Pro 20.04 LTS netty No fix yet —
Ubuntu Pro 18.04 LTS netty No fix yet —
Ubuntu Pro 16.04 LTS netty No fix yet —
Ubuntu Pro 14.04 LTS netty No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling opensearch-3 +2 3.7.0-r5 —
Wolfi rolling opensearch-3-discovery-ec2 +2 3.8.0-r3 —
Wolfi rolling spark-4.1-scala-2.13 4.1.3-r2 —
Wolfi rolling strimzi-kafka-operator-kafka-init +5 1.1.0-r3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-codec-http3 < 4.2.16.Final 4.2.16.Final GHSA-hpcc-26xq-25fv

Advisories 1

References