Skip to main content

Allocation of Resources Without Limits or Throttling in io.netty:netty-codec-http2

CVE-2026-33871

  • io.netty:netty-codec-http2
High
8.7/10

Summary

A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. This issue affects io.netty:netty-codec-http2 versions prior to 4.1.132.Final and 4.2.x prior to 4.2.11.Final.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-770 - Allocation of Resources Without Limits or Throttling

The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

Advisory Timeline

  • Published