CVE-2026-56816: Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

July 22, 2026

Netty’s Http3FrameCodec buffers incoming data for HTTP/3 reserved frame types up to the specified payload length without any limits. The payload length is read directly from the wire and trusted without validation. A bad actor can send a reserved frame with a payload length of up to Integer.MAX_VALUE, causing the server to buffer the data in memory. This leads to an OOM and a gradual Denial of Service due to memory exhaustion as multiple streams are opened.

References

github.com/advisories/GHSA-hpcc-26xq-25fv
github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
github.com/netty/netty/releases/tag/netty-4.2.16.Final
github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv
nvd.nist.gov/vuln/detail/CVE-2026-56816

Code Behaviors & Features

Detect and mitigate CVE-2026-56816 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →