Bug#1142680: netty: CVE-2026-44891 CVE-2026-55831 CVE-2026-55833 CVE-2026-55851 CVE-2026-56745 CVE-2026-56746 CVE-2026-56816 CVE-2026-56817 CVE-2026-56819 CVE-2026-56820

[Salvatore Bonaccorso]

Source: netty
Version: 1:4.1.48-16
Severity: grave
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for netty.

CVE-2026-44891[0]:
| Netty is a network application framework for development of protocol
| servers and clients. Prior to 4.1.136.Final and 4.2.16.Final,
| io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the
| total number of headers or their cumulative size per frame, and the
| maxLineLength parameter only restricts individual header lines. An
| attacker can send a large number of short headers that are
| accumulated in memory inside DefaultStompHeadersSubframe until the
| JVM throws an OutOfMemoryError, causing denial of service for
| servers exposing a STOMP endpoint based on StompSubframeDecoder.
| This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.


CVE-2026-55831[1]:
| Netty is a network application framework for development of protocol
| servers and clients. Prior to 4.1.136.Final and 4.2.16.Final,
| Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry
| count up to the 24-bit frame-length limit and materializes every
| unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote
| SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS
| frame that creates 262144 map entries and amplifies network input
| into heap growth and ordered-map insertion work. This issue is fixed
| in versions 4.1.136.Final and 4.2.16.Final.


CVE-2026-55833[2]:
| Netty is a network application framework for development of protocol
| servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty
| SPDY header decoding continues inflating zlib-compressed header
| blocks after the raw header parser has exceeded `maxHeaderSize` and
| marked the frame truncated in `SpdyFrameCodec`, allowing a remote
| peer to send a small compressed `HEADERS` block that expands into
| much larger raw header data and causes compression-amplified CPU and
| allocation churn. This issue is fixed in versions 4.1.136.Final and
| 4.2.16.Final.


CVE-2026-55851[3]:
| Netty is a network application framework for development of protocol
| servers and clients. In versions 4.2.0.Final up to (but not
| including) 4.2.16.Final, and 4.1.0.Final up to (but not including)
| 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy`
| module performs protocol version detection by reading the 13th byte
| as a signed Java `byte` and widening it to `int` without masking; a
| PROXY protocol v2 binary prefix followed by version byte `0xFF`
| sign-extends to `-1`, collides with the decoder's need-more-data
| sentinel, and causes `ByteToMessageDecoder` to accumulate inbound
| bytes in an unbounded `cumulation` buffer until direct memory is
| exhausted. This issue is fixed in versions 4.1.136.Final and
| 4.2.16.Final.


CVE-2026-56745[4]:
| Netty is a network application framework for development of protocol
| servers and clients. In versions 4.2.0.Final through 4.2.15.Final
| and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler
| in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when
| processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0`
| and stores the partially constructed `FullHttpRequest` in
| `messageMap`; when the remote peer sends `RST_STREAM` for that
| stream or the accumulated content exceeds `maxContentLength`, the
| decoder removes the entry but does not release the pooled `ByteBuf`,
| causing native memory exhaustion. This issue is fixed in versions
| 4.1.136.Final and 4.2.16.Final.


CVE-2026-56746[5]:
| Netty is a network application framework for development of protocol
| servers and clients. Versions 4.2.0.Final through 4.2.15.Final and
| 4.1.0.Final through 4.1.135.Final, are vulnerable to security
| control bypass during the origin evaluation process. CorsHandler
| provides a shortCircuit() configuration designed to reject
| unauthorized cross-origin requests immediately, acting as a security
| control before requests reach the application. However, due to a
| logical operator error in the origin evaluation process, this
| protection can be entirely bypassed. An attacker can bypass the
| short-circuit mechanism by sending a request with an Origin: null
| header. This failure forwards unauthorized requests to the backend
| application, bypassing intended access controls. This issue is fixed
| in versions 4.1.136.Final and 4.2.16.Final.


CVE-2026-56816[6]:
| Netty is a network application framework for development of protocol
| servers and clients. Prior to 4.2.16.Final, Netty's
| `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame
| types up to the wire-specified payload length without limits;
| `decodeFrame` trusts `payLoadLength`, allowing an attacker to open
| multiple QUIC streams and send reserved frames with very large
| payload lengths to cause memory exhaustion and denial of service.
| This issue is fixed in version 4.2.16.Final.


CVE-2026-56817[7]:
| Netty is a network application framework for development of protocol
| servers and clients. In versions 4.2.0.Final through 4.2.15.Final
| and 4.1.0.Final through 4.1.135.Final, any caller that can deliver
| bytes to a Netty channel pipeline containing `XmlDecoder` can send
| XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory`
| instantiated with no security configuration, leaving DTD and entity
| handling active depending on Aalto XML async parser behavior and
| creating conditional XML external entity risk. This issue is fixed
| in versions 4.1.136.Final and 4.2.16.Final.


CVE-2026-56819[8]:
| Netty is a network application framework for development of protocol
| servers and clients. In versions 4.2.0.Final through 4.2.15.Final
| and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer
| can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in
| applications that enable HTTP/2 content decompression via
| `DelegatingDecompressorFrameListener`. When a `DATA` frame is
| processed for a stream whose decompressor has already been closed,
| `Http2Decompressor.decompress(...)` calls
| `decompressor.writeInbound(data.retain())` and does not release the
| retained buffer on the error path, eventually exhausting direct
| memory and crashing the JVM. This issue is fixed in versions
| 4.1.136.Final and 4.2.16.Final.


CVE-2026-56820[9]:
| Netty is a network application framework for development of protocol
| servers and clients. In versions 4.2.0.Final through 4.2.15.Final
| and prior to 4.1.135.Final, `OcspClient` does not validate that the
| `CertificateID` in an OCSP response matches the requested
| `CertificateID`, which can lead to replay attack.
| `OcspClient.validateResponse` accepts a legitimately signed `GOOD`
| status response for an unrelated certificate issued by the same CA,
| allowing bypass of revocation checks for another certificate. This
| issue is fixed in versions 4.1.136.Final and 4.2.16.Final.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-44891
    https://www.cve.org/CVERecord?id=CVE-2026-44891
[1] https://security-tracker.debian.org/tracker/CVE-2026-55831
    https://www.cve.org/CVERecord?id=CVE-2026-55831
[2] https://security-tracker.debian.org/tracker/CVE-2026-55833
    https://www.cve.org/CVERecord?id=CVE-2026-55833
[3] https://security-tracker.debian.org/tracker/CVE-2026-55851
    https://www.cve.org/CVERecord?id=CVE-2026-55851
[4] https://security-tracker.debian.org/tracker/CVE-2026-56745
    https://www.cve.org/CVERecord?id=CVE-2026-56745
[5] https://security-tracker.debian.org/tracker/CVE-2026-56746
    https://www.cve.org/CVERecord?id=CVE-2026-56746
[6] https://security-tracker.debian.org/tracker/CVE-2026-56816
    https://www.cve.org/CVERecord?id=CVE-2026-56816
[7] https://security-tracker.debian.org/tracker/CVE-2026-56817
    https://www.cve.org/CVERecord?id=CVE-2026-56817
[8] https://security-tracker.debian.org/tracker/CVE-2026-56819
    https://www.cve.org/CVERecord?id=CVE-2026-56819
[9] https://security-tracker.debian.org/tracker/CVE-2026-56820
    https://www.cve.org/CVERecord?id=CVE-2026-56820

Regards,
Salvatore