Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-21 | 2 | Disclosure1General1 |
| 2026-07-22 | 1 | Disclosure1 |
| 2026-07-27 | 1 | Patch1 |
CVE-2026-56819 Netty is a network application framework for development of protocol servers and clients. In versions http://4.2.0.Final through http://4.2.15.Final and http://4.1.0.Final through 4.1.135… https://www.cve.org/CVERecord?id=CVE-2026-56819
Post summary
Disclosed vulnerability CVE-2026-56819 in Netty affecting versions 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135, with no PoC, exploit, or patch details provided.
🚨 HIGH SEVERITY: CVE-2026-56819 (CVSS 7.5) Netty HTTP/2 memory leak vulnerability affects versions 4.1.0-4.1.135 & 4.2.0-4.2.15. Remote attackers can exhaust memory & crash JVM. Patch NOW to 4.1.136+ or 4.2.16+ #CVE #PatchNow https://t.co/Ohp2Szk45j
Post summary
The tweet announces a high‑severity Netty HTTP/2 memory‑leak CVE (CVE‑2026‑56819), warns of memory exhaustion and JVM crashes, and urges users to upgrade to patched versions.
CVE-2026-56819 Memory Leak in Netty HTTP/2 Decompression via Unrelease ByteBuf https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-56819
Post summary
The snippet announces CVE‑2026‑56819, a memory‑leak vulnerability in Netty’s HTTP/2 decompression due to an unreleased ByteBuf, but offers no evidence of proof‑of‑concepts, active exploitation, or remediation.
🚨*CVE* CVE-2026-56819 Netty is a network application framework for development of protocol servers and clients. In versions http://4.2.0.Final through http://4.2.15.Final and http://4.1.0.Final through 4.1.135… https://www.cve.org/CVERecord?id=CVE-2026-56819 -… http://infoflow.cloud`
Post summary
The post only references CVE‑2026‑56819 and lists affected Netty versions, without any further technical details, PoC, exploit code, patch, or exploitation evidence.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | netty | netty | - | - | - |