CVE-2026-55833: netty Uncontrolled Resource Consumption

CVSS: 7.5v3.1HighAnalyzed

AliasesUBUNTU-CVE-2026-55833DEBIAN-CVE-2026-55833CGA-23fv-wg4g-gg3p+841 more

Published 20-07-2026Last modified 21-07-2026

Vulnerability summary

CVE-2026-55833 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in netty. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.8% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

40/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.66%

0%100%

Low · +0.24 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 5 · Related 3

OPENSUSE-SU-2026:11394-1 RHSA-2026:70228 RHSA-2026:70229 RHSA-2026:70230 SUSE-SU-2026:3482-1 CGA-7FGQ-Q63W-H255

Timeline

20-07-2026
PublishedVulnerability first disclosed.
21-07-2026
Last modifiedVulnerability information updated.

Description

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.66%

Chance of exploitation in the next 30 days

Percentile

51%

Versus all other CVEs

30-day change

+0.24 pp

From 0.42% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

githubUnverified
Netty
Maturity: poc

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Chainguard200 products

airbyte-server< 2.0.0-r8
airbyte-server-fips< 2.0.0-r10
akhq< 0.27.1-r12
apache-activemq-artemis< 2.55.0-r1
apache-camel-karavan-devmode< 4.18.1-r8

apache-hop< 2.18.1-r10
apache-hop-fips< 2.18.1-r6
apache-nifi< 2.10.0-r6
apache-pulsar-4.0< 4.0.12-r2
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.3-r3
apache-pulsar-fips-4.0< 4.0.12-r2
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.3-r2
apicurio-registry< 3.3.0-r11
apicurio-registry-3-operator< 3.3.0-r11
apicurio-registry-3-operator-fips< 3.3.0-r8
apicurio-registry-fips< 3.3.0-r8
camunda-8.8< 8.8.31-r2
camunda-8.9< 8.9.13-r2
camunda-zeebe-8.6< 8.6.39-r6
camunda-zeebe-8.7< 8.7.35-r1
camunda-zeebe-8.8< 8.8.32-r1
camunda-zeebe-8.9< 8.9.13-r1
celeborn-0.5All versions (No fix recorded) | < 0.5.4-r32
celeborn-0.6All versions (No fix recorded) | < 0.6.3-r13
celeborn-0.7< 0.7.0-r3 | < 0.7.0-r5
cloudwatch-exporter< 0.18.0-r1 | < 0.18.0-r5
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.22-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4< 9.4.8-r0
commercial-elasticsearch-9.5< 9.5.5-r0
conductor< 3.31.0-r5
conductor-fips< 3.31.0-r6
druid< 37.0.0-r56 | < 37.0.0-r45
elasticsearch-8.19< 8.19.19-r1
elasticsearch-8.19-iamguarded< 8.19.19-r1
elasticsearch-8.19-iamguarded-fips< 8.19.19-r1
elasticsearch-9.1All versions (No fix recorded)
elasticsearch-9.1-iamguardedAll versions (No fix recorded)
elasticsearch-9.1-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.2< 9.2.8-r12
elasticsearch-9.2-iamguarded< 9.2.8-r12
elasticsearch-9.2-iamguarded-fips< 9.2.8-r12
elasticsearch-9.3< 9.3.8-r5
elasticsearch-9.3-iamguarded< 9.3.8-r5
elasticsearch-9.3-iamguarded-fips< 9.3.7-r9
elasticsearch-9.4< 9.4.5-r2
elasticsearch-9.4-iamguarded< 9.4.5-r2
elasticsearch-9.4-iamguarded-fips< 9.4.5-r3
elasticsearch-9.5< 9.5.1-r2
elasticsearch-9.5-iamguarded< 9.5.1-r2
elasticsearch-9.5-iamguarded-fips< 9.5.2-r2
elasticsearch-fips-8.19< 8.19.19-r1
elasticsearch-fips-9.1All versions (No fix recorded)
elasticsearch-fips-9.2< 9.2.8-r12
elasticsearch-fips-9.3< 9.3.7-r9
elasticsearch-fips-9.4< 9.4.5-r3
elasticsearch-fips-9.5< 9.5.2-r2
floci< 1.5.33-r3
floci-az< 0.9.0-r3
flyway< 13.0.0-r1
flyway-fips< 13.0.0-r3
gremlin-server< 3.8.1-r2
grpc-java-fips-1.56.0-m2< 1.56.0-r7
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r14 | < 3.5.0-r3 | All versions (No fix recorded)
hono-adapter-mqtt< 2.7.0-r29
hono-cli< 2.7.0-r29
hono-service-auth< 2.7.0-r29
hono-service-command-router< 2.7.0-r29
hono-service-device-registry-jdbc< 2.7.0-r29
infinispan-15.0< 15.0.22-r14
infinispan-15.1< 15.1.7-r25
infinispan-15.2< 15.2.6-r23
infinispan-16.0< 16.0.14-r2
infinispan-16.1< 16.1.4-r7
infinispan-16.2< 16.2.1-r2
kafbat-ui< 1.5.0-r10
kafbat-ui-fips< 1.5.0-r6
kafka_exporter-strimzi-compat< 1.2.0-r5 | < 1.2.0-r4
kafka-bridge< 1.0.0-r9
kafka-bridge-fips< 1.0.0-r6
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.2< 2025.2.4-r6
kayenta-2025.4< 2025.4.6-r11
kayenta-2026.0< 2026.0.4-r17
kayenta-2026.1< 2026.1.2-r1
kayenta-fips-2025.2< 2025.2.4-r7
kayenta-fips-2025.4< 2025.4.6-r6
kayenta-fips-2026.0< 2026.0.4-r11
kayenta-fips-2026.1< 2026.1.2-r1
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.4-r24
keycloak-26.6-iamguarded-compat< 26.6.4-r24
keycloak-26.6-operator< 26.6.4-r24
keycloak-26.7< 26.7.0-r4
keycloak-26.7-iamguarded-compat< 26.7.0-r4
keycloak-26.7-operator< 26.7.0-r4
keycloak-fips-26.5< 26.5.7-r10
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r10
keycloak-fips-26.5-operator< 26.5.7-r10
keycloak-fips-26.6< 26.6.4-r10
keycloak-fips-26.6-iamguarded-fips< 26.6.4-r10
keycloak-fips-26.6-operator< 26.6.4-r10
keycloak-fips-26.7< 26.7.0-r3
keycloak-fips-26.7-iamguarded-fips< 26.7.0-r3
keycloak-fips-26.7-operator< 26.7.0-r3
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r12
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r12
knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r14
knative-kafka-broker-1.21-receiver-loom< 1.21.4-r14
knative-kafka-broker-1.22-dispatcher-loom< 1.22.2-r8
knative-kafka-broker-1.22-receiver-loom< 1.22.2-r8
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r10
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r10
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.4-r9
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.4-r9
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.2-r11
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.2-r11
kserve-modelmesh< 0.12.0-r38
localstack< 4.14.0-r20
logstash-8.19< 8.19.19-r3
logstash-8.19-iamguarded-compat< 8.19.19-r3
logstash-8.19-with-output-opensearch< 8.19.19-r3
logstash-9.2< 9.2.8-r6
logstash-9.2-iamguarded-compat< 9.2.8-r6
logstash-9.2-with-output-opensearch< 9.2.8-r6
logstash-9.3All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded)
logstash-9.4< 9.4.4-r3
logstash-9.4-iamguarded-compat< 9.4.4-r3
logstash-fips-9.4< 9.4.4-r1
logstash-fips-9.4-iamguarded-compat< 9.4.4-r1
management-api-for-apache-cassandra-5.0< 0.1.122-r2
metabase< 0.63.2-r3
neo4j-2025.12All versions (No fix recorded)
neo4j-2026.01All versions (No fix recorded)
neo4j-2026.02< 2026.02.3-r4
neo4j-2026.03< 2026.03.1-r4
neo4j-2026.04< 2026.04.0-r3
neo4j-2026.05< 2026.05.0-r12
neo4j-2026.05-docker-publishAll versions (No fix recorded)
neo4j-2026.06< 2026.06.0-r4
neo4j-5.26< 5.26.28-r6
nuxeo-2023< 2023.45-r3
opensearch-2< 2.19.6-r6
opensearch-2-ml-commons< 2.19.6-r6
opensearch-2-performance-analyzer< 2.19.6-r6
opensearch-2-repository-azure< 2.19.6-r6
opensearch-2-repository-s3< 2.19.6-r6
opensearch-2-security< 2.19.6-r6
opensearch-2-transport-nio< 2.19.6-r6
opensearch-3< 3.7.0-r5
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-ml-commons< 3.7.0-r5
opensearch-3-neural-search< 3.8.0-r3
opensearch-3-notifications< 3.7.0-r5
opensearch-3-performance-analyzer< 3.7.0-r5
opensearch-3-repository-azure< 3.7.0-r5
opensearch-3-repository-s3< 3.7.0-r5
opensearch-3-security< 3.7.0-r5
opensearch-3-security-analytics< 3.8.0-r2
opensearch-fips-3< 3.7.0-r5
opensearch-fips-3-ml-commons< 3.7.0-r5
opensearch-fips-3-notifications< 3.7.0-r5
opensearch-fips-3-performance-analyzer< 3.7.0-r5
opensearch-fips-3-repository-azure< 3.7.0-r5
opensearch-fips-3-repository-s3< 3.7.0-r5
opensearch-fips-3-security< 3.7.0-r5
opensearch-fips-3-security-analytics< 3.8.0-r2
pinot< 1.5.1-r6
pinot-fips< 1.5.1-r6
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
reposilite< 3.5.28-r7
request-9047-keycloak-fips-26.4< 26.4.7-r23
request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r23
request-9047-keycloak-fips-26.4-operator< 26.4.7-r23
request-9047-keycloak-fips-26.5< 26.5.7-r15
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r15
request-9047-keycloak-fips-26.5-operator< 26.5.7-r15
request-9047-keycloak-fips-26.6< 26.6.4-r5
request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.4-r5
request-9047-keycloak-fips-26.6-operator< 26.6.4-r5
s3proxy< 3.3.0-r6
s3proxy-fips< 3.3.0-r5
seata-server< 2.7.0-r3
sonarqubeAll versions (No fix recorded)
spark-3.5-scala-2.12< 3.5.9-r2
spark-3.5-scala-2.13< 3.5.9-r2
spark-4.0-scala-2.13< 4.0.4-r1
spark-4.1-scala-2.13< 4.1.3-r2

Show all 200

1 vendor · 200 products · Showing 200 of 307. Use Open JSON for the complete list.

References

11 links

github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77cX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bX Refsource MISCREPORTFIXWEBPatch
github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6X Refsource MISCREPORTFIXWEBPatch
github.com/netty/netty/releases/tag/netty-4.1.136.FinalX Refsource MISCWEBRelease Notes
github.com/netty/netty/releases/tag/netty-4.2.16.FinalX Refsource MISCWEBRelease Notes
ubuntu.com/security/CVE-2026-55833REPORT
www.cve.org/CVERecord?id=CVE-2026-55833REPORT
security-tracker.debian.org/tracker/CVE-2026-55833Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55833.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-55833Advisory

Show all 11 references

github.com/netty/nettyPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities