Log in Start free

Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M

CVE-2026-33871Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

High 7.5

In plain English

A high-severity resource allocation without limits in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.1%top 33.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nettyno fix listedDEBIAN-CVE-2026-33871
Debian:13nettyno fix listedDEBIAN-CVE-2026-33871
Debian:14nettyno fix listedDEBIAN-CVE-2026-33871
Mavenio.netty:netty-codec-http24.2.11.FinalGHSA-w9fj-cfpg-grvv
Mavenio.netty:netty-codec-http24.1.132.FinalGHSA-w9fj-cfpg-grvv
Ubuntu:25.10nettyno fix listedUBUNTU-CVE-2026-33871
Ubuntu:26.10nettyno fix listedUBUNTU-CVE-2026-33871

Affected products (as reported)

VendorProductVersions
netty netty < 4.1.132.Final>= 4.2.0.Alpha1, < 4.2.10.Final

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References