🚨 HIGH - Netty SPDY-to-HTTP decoder native ByteBuf leak leads to memory exhaustion (CVE-2026-56745) Netty’s SpdyHttpDecoder (SPDY-to-HTTP codec) leaks native memory when processing client-initiated SYN_STREAM frames with FLAG_FIN=0 and buffering request content. The root cause is improper resource management: the decoder drops the stored request on RST_STREAM or when buffered data exceeds maxContentLength without releasing the pooled ByteBuf. An attacker can exploit this remotely by opening SPDY streams, sending SYN_STREAM without FIN, then triggering RST_STREAM or forcing maxContentLength overruns to repeatedly orphan pooled buffers with no authentication required beyond network access to the service. Successful exploitation results in native memory exhaustion and a denial of service as the JVM/native allocator runs out of direct memory and the process becomes unstable or crashes. 👉 Affected: netty (SpdyHttpDecoder / SPDY codec; versions not specified) | Upgrade to Vendor fix version (pending) or disable SPDY codec / enforce strict stream limits until patched
Post summary
The text announces a newly disclosed Netty memory‑leak vulnerability (CVE‑2026‑56745), detailing the technical mechanism, potential exploitation method, and recommended mitigations or patching steps without providing a PoC or evidence of active attacks.