CyberRota Analysis
AI-GeneratedThe vulnerability affects the `SpdyHttpDecoder` handler in specific versions of the Netty framework, which can lead to native memory exhaustion due to improper handling of pooled `ByteBuf` allocations during the processing of client-initiated `SYN_STREAM` frames. This can result in degraded application performance or crashes, making it critical for developers and organizations using the affected Netty versions to prioritize upgrading to the patched releases (4.1.136.Final or 4.2.16.Final) to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Related CVEs
Other vulnerabilities affecting the same vendor(s)