Cloudanix VulnDB

CVE-2026-56816

High · 7.5

CVSS

7.5

EPSS

0.6%

Published

Jul 21, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in a widely used networking library lets attackers send crafted data that can overwhelm and shut down servers handling certain web traffic.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; decodeFrame trusts payLoadLength, allowing unbounded memory allocation when processing frames over QUIC streams.

Why it matters to the business

Attackers can trigger denial of service that renders affected services unavailable, leading to operational disruption, potential revenue loss, and the need for emergency restarts or resource scaling; low urgency given stable low exploit probability and lack of known campaigns.

How an attack unfolds

An attacker opens multiple QUIC streams and sends reserved frames containing very large payload lengths, causing the codec to allocate memory far beyond normal limits until the process exhausts available RAM and crashes.

How to fix it

Upgrade Netty to version 4.2.16.Final or later; if immediate upgrade is not feasible, restrict or disable HTTP/3 support until the fix can be applied.

How to confirm the fix worked

Confirm the running Netty version is 4.2.16.Final or newer via dependency inspection or application startup logs; test by attempting to send large reserved frames and verify memory usage remains bounded.

Typical attack path

  1. Establish multiple QUIC connections or streams to the target
  2. Send HTTP/3 reserved frames with oversized payLoadLength values
  3. Repeat the pattern across streams to accelerate memory consumption
  4. Observe service degradation or crash due to out-of-memory conditions

How to detect it

Review application logs for sudden memory exhaustion events or crashes during HTTP/3 frame processing; correlate with QUIC connection volume and look for patterns of reserved frame types with unexpectedly large declared lengths.

What your security team should do

  • Prioritize upgrade to Netty 4.2.16.Final across all deployments
  • Monitor memory consumption and QUIC stream activity for anomalous spikes
  • Apply network-level rate limiting on QUIC streams where possible
  • Review downstream dependents for transitive Netty usage and schedule coordinated updates

The record

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities