Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-55833: Netty SPDY zlib compression amplification vulnerability
CVE-2026-55833
CVE-2026-55833
Summary
The Netty SPDY library has a vulnerability that allows a malicious user to cause excessive CPU and memory usage by sending a compressed header that expands into a much larger amount of data. This can impact performance and potentially cause system issues. To fix this, update to Netty version 4.1.136.Final or 4.2.16.Final.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| netty | netty | >= 4.2.0.Final, < 4.2.16.Final |
Original title
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
Original description
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
mitre CVSS3.1
7.5
Vulnerability type
CWE-400
Uncontrolled Resource Consumption
- https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c x_refsource_CONFIRM
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b x_refsource_MISC
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final x_refsource_MISC
Published: 20 Jul 2026 · Updated: 21 Jul 2026 · First seen: 20 Jul 2026