Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

Summary

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Timeline

1. Jul 21, 2026, 10:11 PM UTCCVE published
2. Jul 23, 2026, 1:55 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: partial

3. Jul 23, 2026, 1:55 PM UTCRecord last updated

Affected versions

• netty netty

  From 4.2.0.Final · fixed in 4.2.16.Final; From 4.1.0.Final · fixed in 4.1.136.Final

• io.netty:netty-codec-http2Maven

  From 4.2.0 · fixed in 4.2.16.Final

• io.netty:netty-codec-http2Maven

  From 4.1.0.Final · fixed in 4.1.136.Final

References 6