Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-05-13T18:22:21 netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.

This is an Important denial of service vulnerability in Netty's HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Cryostat 4 on RHEL 9 2026-06-22T00:00:00Z RHSA-2026:28010 cryostat/cryostat-reports-rhel9:4.2.0-10 Cryostat 4 on RHEL 9 2026-06-22T00:00:00Z RHSA-2026:28010 cryostat/cryostat-rhel9:4.2.0-10 Cryostat 4 on RHEL 9 2026-06-22T00:00:00Z RHSA-2026:28010 cryostat/jfr-datasource-rhel9:4.2.0-10 Red Hat AMQ Broker 7.13.6 2026-09-10T00:00:00Z RHSA-2026:66545 netty-codec-http Red Hat AMQ Broker 7.14.1 2026-09-10T00:00:00Z RHSA-2026:66488 netty-codec-http Red Hat AMQ Broker 7.14.1 2026-09-10T00:00:00Z RHSA-2026:66488 netty-codec-http2 Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 2026-07-09T00:00:00Z RHSA-2026:37390 netty-codec-http Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 2026-07-09T00:00:00Z RHSA-2026:37390 netty-codec-http2 Red Hat build of Quarkus 3.27.4 2026-06-10T00:00:00Z RHSA-2026:23808 netty-codec-http Red Hat build of Quarkus 3.27.4 2026-06-10T00:00:00Z RHSA-2026:23808 netty-codec-http2 Red Hat build of Quarkus 3.33.2 2026-06-10T00:00:00Z RHSA-2026:24502 Red Hat Data Grid 8.6.2 2026-07-20T00:00:00Z RHSA-2026:41951 netty-codec-http Red Hat Data Grid 8.6.2 2026-07-20T00:00:00Z RHSA-2026:41951 netty-codec-http2 Red Hat JBoss Enterprise Application Platform 7.4.25 2026-08-11T00:00:00Z RHSA-2026:53806 netty-codec-http Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 2026-08-11T00:00:00Z RHSA-2026:53644 eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap Red Hat JBoss Enterprise Application Platform 8.1 2026-08-04T00:00:00Z RHSA-2026:50085 netty-codec-http2 Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-eap-product-conf-parent-0:801.7.1-1.GA_redhat_00001.1.el10eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-netty-0:4.1.135-1.Final_redhat_00001.1.el10eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el10eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-wildfly-0:8.1.7.1-1.GA_redhat_00004.1.el10eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-eap-product-conf-parent-0:801.7.1-1.GA_redhat_00001.1.el8eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-jose4j-0:0.9.6-2.redhat_00002.1.el8eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-netty-0:4.1.135-1.Final_redhat_00001.1.el8eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el8eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-wildfly-0:8.1.7.1-1.GA_redhat_00004.1.el8eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-eap-product-conf-parent-0:801.7.1-1.GA_redhat_00001.1.el9eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-jose4j-0:0.9.6-2.redhat_00002.1.el9eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-netty-0:4.1.135-1.Final_redhat_00001.1.el9eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el9eap Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 2026-08-03T00:00:00Z RHSA-2026:49700 eap8-wildfly-0:8.1.7.1-1.GA_redhat_00004.1.el9eap Streams for Apache Kafka 2.9.4 2026-07-02T00:00:00Z RHSA-2026:34608 netty-codec-http2 Streams for Apache Kafka 3.2.1 2026-08-12T00:00:00Z RHSA-2026:54435 netty-codec-http Streams for Apache Kafka 3.2.1 2026-08-12T00:00:00Z RHSA-2026:54435 netty-codec-http2 Red Hat OpenShift AI 2.25 2026-07-21T00:00:00Z RHSA-2026:42644 rhoai/odh-modelmesh-rhel9:1783443816 Red Hat OpenShift AI 2.25 2026-09-08T00:00:00Z RHSA-2026:65126 rhoai/odh-trustyai-service-rhel9:1788198681 Red Hat OpenShift Dev Spaces 3.28 2026-06-10T00:00:00Z RHSA-2026:25123 devspaces/openvsx-rhel9:1780948325 Red Hat OpenShift Dev Spaces 3.28 2026-06-10T00:00:00Z RHSA-2026:25123 devspaces/pluginregistry-rhel9:1780696380 Red Hat OpenShift Dev Spaces 3.28 2026-06-10T00:00:00Z RHSA-2026:25123 devspaces/server-rhel9:1780694994 Red Hat OpenShift Dev Spaces 3.29 2026-07-08T00:00:00Z RHSA-2026:36820 devspaces/multicluster-redirector-rhel9:1782989027 Cryostat 4 Affected netty-codec-http2 OpenShift Serverless Affected openshift-serverless-1/kn-ekb-dispatcher-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-ekb-receiver-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9 Red Hat AMQ Clients Affected netty-codec-http Red Hat build of Apache Camel 4 for Quarkus 3 Not affected netty-codec-http Red Hat build of Apache Camel 4 for Quarkus 3 Not affected netty-codec-http2 Red Hat build of Apicurio Registry 2 Will not fix netty-codec-http Red Hat build of Apicurio Registry 2 Will not fix netty-codec-http2 Red Hat build of Apicurio Registry 3 Affected netty-codec-http Red Hat build of Apicurio Registry 3 Affected netty-codec-http2 Red Hat build of Debezium 3 Will not fix netty-codec-http Red Hat build of Debezium 3 Will not fix netty-codec-http2 Red Hat Build of Keycloak Affected netty-codec-http Red Hat Build of Keycloak Affected netty-codec-http2 Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9 Red Hat Build of Keycloak Affected rhbk/keycloak-rhel9-operator Red Hat Build of Keycloak Affected rhbk-openshift-rhel9/rhbk-openshift-rhel9 Red Hat Build of Keycloak Affected rhbk-rhel9-operator/rhbk-rhel9-operator Red Hat build of OptaPlanner 8 Affected netty-codec-http Red Hat build of OptaPlanner 8 Affected netty-codec-http2 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected bazel6 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected bazel7 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected bazel8 Red Hat Fuse 7 Will not fix netty-codec-http Red Hat Fuse 7 Will not fix netty-codec-http2 Red Hat JBoss Enterprise Application Platform 7 Not affected netty-codec-http2 Red Hat JBoss Enterprise Application Platform Expansion Pack Will not fix netty-codec-http Red Hat JBoss Enterprise Application Platform Expansion Pack Affected netty-codec-http2 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-modelmesh-rhel8 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-spark-operator-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-service-rhel8 Red Hat Process Automation 7 Will not fix netty-codec-http Red Hat Process Automation 7 Will not fix netty-codec-http2 Red Hat Satellite 6 Not affected candlepin Red Hat Satellite 6 Not affected satellite:el8/candlepin Red Hat Single Sign-On 7 Will not fix netty-codec-http Red Hat Single Sign-On 7 Will not fix netty-codec-http2 streams for Apache Kafka 2 Affected netty-codec-http https://www.cve.org/CVERecord?id=CVE-2026-42587 https://nvd.nist.gov/vuln/detail/CVE-2026-42587 https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv