CVE-2026-56819: Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
A remote, unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in
applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener.
When a DATA frame is processed for a stream whose decompressor has already been closed,
Http2Decompressor.decompress(...) retains the frame buffer but never releases it on the error
path, so its reference count never returns to zero. Repeating this over a long-lived HTTP/2
connection exhausts direct memory and crashes the JVM with OutOfMemoryError — a denial of service.
References
- github.com/advisories/GHSA-93wv-jw9v-4972
- github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- github.com/netty/netty/releases/tag/netty-4.1.136.Final
- github.com/netty/netty/releases/tag/netty-4.2.16.Final
- github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972
- nvd.nist.gov/vuln/detail/CVE-2026-56819
Code Behaviors & Features
Detect and mitigate CVE-2026-56819 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →