Bug 2505911 (CVE-2026-56745)

Summary:	CVE-2026-56745 netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abrianik, anthomas, ant, anujha, aschwart, asoldano, asyoung, aszczucz, ataylor, avibelli, bbaranow, bbrownin, bgeorges, bmaxwell, boliveir, bstansbe, ccranfor, cescoffi, chfoley, cmah, dandread, dbruscin, dhanak, dkreling, dlofthou, drichtar, drosa, dsimansk, eaguilar, ebaron, ehelms, ehugonne, ewittman, fmariani, fmongiar, ggainey, ggrzybek, gmalinko, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jmartisk, jmatsuok, jnethert, jpasqual, jpechane, jraez, jtolenti, juwatts, jwon, kaycoth, kgaikwad, kingland, kvanderr, lthon, manderse, mcarlett, mdellweg, mhulan, mnovotny, mosmerov, mposolda, msvehla, nipatil, nmoumoul, nwallace, olubyans, osousa, pantinor, parichar, pberan, pcreech, pesilva, pgallagh, pjindal, pmackay, prichard, probinso, rchan, rgodfrey, rguimara, rkubis, rmartinc, rruss, rstancel, rstepani, rsvoboda, sausingh, sbiarozk, sdawley, smallamp, ssilvert, sthirugn, sthorger, swoodman, tasato, tcunning, thjenkin, tmalecek, tqvarnst, vdosoudi, vmuzikar, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-21 22:53:10 UTC

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Comment 1 errata-xmlrpc 2026-07-30 07:45:32 UTC

This issue has been addressed in the following products:

  Red Hat Build of Apache Camel 4.18 for Quarkus 3.33

Via RHSA-2026:48118 https://access.redhat.com/errata/RHSA-2026:48118

Comment 3 errata-xmlrpc 2026-08-13 14:51:32 UTC

This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16

Via RHSA-2026:54622 https://access.redhat.com/errata/RHSA-2026:54622

Comment 4 errata-xmlrpc 2026-09-10 16:37:54 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.14.1

Via RHSA-2026:66488 https://access.redhat.com/errata/RHSA-2026:66488

Comment 5 errata-xmlrpc 2026-09-10 23:25:56 UTC

This issue has been addressed in the following products:

  Red Hat AMQ Broker 7.13.6

Via RHSA-2026:66545 https://access.redhat.com/errata/RHSA-2026:66545

Comment 6 Jon Orris 2026-09-16 17:17:18 UTC

This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:68333 https://access.redhat.com/errata/RHSA-2026:68333

Comment 7 Jon Orris 2026-09-21 12:20:19 UTC

This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.3

Via RHSA-2026:69296 https://access.redhat.com/errata/RHSA-2026:69296

Comment 8 Jon Orris 2026-09-22 12:57:19 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8

Via RHSA-2026:70228 https://access.redhat.com/errata/RHSA-2026:70228

Comment 9 Jon Orris 2026-09-22 12:59:43 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10

Via RHSA-2026:70230 https://access.redhat.com/errata/RHSA-2026:70230

Comment 10 Jon Orris 2026-09-22 13:01:52 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9

Via RHSA-2026:70229 https://access.redhat.com/errata/RHSA-2026:70229

Comment 11 Jon Orris 2026-09-22 15:36:52 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.1

Via RHSA-2026:70277 https://access.redhat.com/errata/RHSA-2026:70277

Comment 12 Jon Orris 2026-10-06 07:26:59 UTC

This issue has been addressed in the following products:

  Red Hat build of Apicurio Registry 3.3.3

Via RHSA-2026:76637 https://access.redhat.com/errata/RHSA-2026:76637