Loading vulnerability…
HTTP/2 CONTINUATION Frame Flood Denial of Service in Netty
CVE-2026-33871 is a denial-of-service vulnerability in Netty's HTTP/2 server implementation affecting versions before 4.1.132.Final in the 4.1 branch and 4.2.10.Final in the 4.2 branch. The server does not limit the number of HTTP/2 CONTINUATION frames it processes. A remote attacker can flood the server with zero-byte CONTINUATION frames, bypassing existing size-based protections and causing excessive CPU consumption with minimal bandwidth. Successful exploitation can render the server unresponsive.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can exhaust CPU resources and make affected Netty HTTP/2 services unresponsive, disrupting legitimate requests and service availability. The vulnerability is rated High, with a CVSS v3.1 base score of 7.5. No confidentiality or integrity impact is identified.
If you can’t patch tonight, do this now.
No vulnerability-specific interim workaround is documented. Existing frame-payload or header-size limits alone are insufficient because zero-byte CONTINUATION frames bypass size-based protections.
Patch, then assume compromise.
Upgrade Netty, including netty-codec-http2 and related dependencies, to 4.1.132.Final or later in the 4.1 branch. For the 4.2 branch, the vulnerability description identifies 4.2.10.Final as fixed, while a separate advisory recommends 4.2.11.Final or later; selecting 4.2.11.Final or a later supported release satisfies both recommendations. For products bundling Netty, apply the vendor-supported security update rather than independently replacing bundled libraries.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.