In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec… (CVE-2026-56745)

The SpdyHttpDecoder handler in Netty's SPDY-to-HTTP codec has a vulnerability that causes a pooled ByteBuf memory leak during the processing of client-initiated SYN_STREAM frames. Specifically, when an RST_STREAM frame is received or when the content length exceeds a configured limit, the allocated ByteBuf is removed from internal tracking but not released, resulting in native memory exhaustion. This affects Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, as well as several specific package versions listed. The CVSS v3.1 score is 7.5, indicating a medium severity with network attack vector, low complexity, no privileges required, no user interaction, and an impact limited to availability.

The vulnerability leads to native memory exhaustion due to a memory leak in the ByteBuf pool when processing certain SPDY frames. This can cause denial of service by exhausting system memory resources, impacting application availability. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided in the data, users should monitor vendor advisories for updates. Until a fix is available, consider limiting exposure to untrusted clients sending SPDY SYN_STREAM frames or applying resource limits to mitigate memory exhaustion risks.