CVE-2026-55833— Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55833
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
Source: NVD (National Vulnerability Database)
Vulnerability Description
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-55833
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCVerified env Premium
Reproduced successfully in a real sandbox· Below is the actual recording of building the environment and exploiting the vulnerability.
Success marker:
VULNERABLE: SpdyHeaderBlockZlibDecoder kept inflating after maxHeaderSize=8192 truncation; inflater produced 16777234 bytes (>= 2048x the cap). PROOF_7887ff0760fc2197Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+claude_code · 11223 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-55833
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55833 (1)
Vendor Pages for CVE-2026-55833 (2)
- 🔗 Release netty-4.2.16.Final · netty/netty · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: netty
- CVE-2026-55831
Netty SPDY SETTINGS frame count materializes unbounded setti - CVE-2026-44891
Netty: Denial of Service via Unbounded Headers in StompSubfr - CVE-2026-50560
Netty susceptible to HTTP/2 Reset Attack with different on-t - CVE-2026-50020
Netty's HttpObjectDecoder skips arbitrary initial control ch - CVE-2026-50011
Netty has unbounded pre-allocation in RedisArrayAggregator f
Same vendor: netty
- CVE-2026-55831
Netty SPDY SETTINGS frame count materializes unbounded setti - CVE-2026-44891
Netty: Denial of Service via Unbounded Headers in StompSubfr - CVE-2026-50560
Netty susceptible to HTTP/2 Reset Attack with different on-t - CVE-2026-50020
Netty's HttpObjectDecoder skips arbitrary initial control ch - CVE-2026-50011
Netty has unbounded pre-allocation in RedisArrayAggregator f
Same weakness: CWE-400
- CVE-2026-56145
Uncontrolled Resource Consumption in Elasticsearch Leading t - CVE-2026-53596
FreeScout has unrestricted file upload without rate limiting - CVE-2026-45713
Mailpit: Unauthenticated remote memory-exhaustion DoS via un - CVE-2026-59173
Apache Traffic Server: DoS vulnerability in HTTP/2 via stall - CVE-2026-56740
JLine: Unauthenticated Remote Memory Exhaustion via Unbounde
V. Comments for CVE-2026-55833
No comments yet