CyberRota Analysis
AI-GeneratedApplications using Netty versions 4.2.0.Final to 4.2.15.Final and 4.1.0.Final to 4.1.135.Final are vulnerable to a memory exhaustion attack via HTTP/2 content decompression, allowing remote unauthenticated peers to leak direct `ByteBuf` buffers. This vulnerability can lead to JVM crashes due to exhausted direct memory resources. Organizations utilizing affected versions should prioritize upgrading to versions 4.1.136.Final or 4.2.16.Final to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Related CVEs
Other vulnerabilities affecting the same vendor(s)