Netty fixes 22 flaws including SNI memory-exhaustion DoS
Netty published a broad set of security advisories covering **22 vulnerabilities** across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including **HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling**. Reported consequences include uncontrolled memory allocation, `ByteBuf` and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse.
One of the most serious flaws, **`CVE-2026-45416`**, allows a remote attacker to send as little as **nine bytes** in a crafted TLS `ClientHello` and trigger roughly **16 MiB** of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects **Netty 4.1.x before `4.1.135.Final`** and **4.2.0.Final through `4.2.14.Final`**, and was fixed in **`4.1.135.Final`** and **`4.2.15.Final`**; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.
Jun 12, 2026
Netty WebSocket Frame Handling Flaw Enables JBoss Server Memory Exhaustion
Red Hat addressed **CVE-2014-0193**, a low-severity denial-of-service flaw in Netty's `WebSocket08FrameDecoder`. An unauthenticated remote attacker could send a sequence of `TextWebSocketFrame` and `ContinuationWebSocketFrame` messages that caused uncontrolled memory aggregation, resulting in an `OutOfMemoryException` and potentially crashing or degrading an affected server. Netty fixed the issue in its 3.x and 4.x branches; Netty 3.2.x was not affected because it lacked the vulnerable WebSocket implementation.
The remediation was delivered to affected JBoss products through Red Hat security advisories, including **RHSA-2014:1020** for JBoss EAP 6. Red Hat updated Netty to `netty-3.6.9-1.Final_redhat_1.1.ep6.el6`, incorporating upstream commit `4cc400ce2145a72820119b0eaab838d5d9263022`, and verified the fix in EAP 6.3.0.ER10. Organizations operating affected JBoss deployments should apply the relevant Red Hat errata and verify that bundled Netty components are updated.
Mar 24, 2015
DoS Flaws in Micronaut and Netty Let Remote Attackers Exhaust Server Resources
Two high-severity denial-of-service vulnerabilities were disclosed in widely used Java infrastructure components, allowing remote attackers to exhaust CPU and memory and disrupt application availability without authentication. In Micronaut, `CVE-2026-33013` affects versions before `4.10.16` and `3.10.5` and is caused by improper handling of descending array indices during `application/x-www-form-urlencoded` body binding in `JsonBeanPropertyBinder::expandArrayToThreshold`. A crafted request using indexed parameters such as `authors[1].name` followed by `authors[0].name` can trigger a non-terminating loop, CPU exhaustion, and an `OutOfMemoryError`.
Netty separately patched `CVE-2026-33871`, a denial-of-service flaw in HTTP/2 processing that affects versions before `4.1.132.Final` and `4.2.10.Final`. The bug lets attackers flood servers with `CONTINUATION` frames because the framework did not enforce a limit on their number, and existing size-based protections could be bypassed with zero-byte frames. The result is excessive CPU consumption with minimal bandwidth, potentially leaving HTTP/2 services unresponsive. The issues are tracked as `CWE-835` in Micronaut and `CWE-770` in Netty, and both vendors released fixed versions for affected branches.
Mar 27, 2026
