CVE-2026-33871

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

References

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json

https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv

https://bugzilla.redhat.com/show_bug.cgi?id=2452456

https://access.redhat.com/security/cve/CVE-2026-33871

https://access.redhat.com/errata/RHSA-2026:8509

https://access.redhat.com/errata/RHSA-2026:8159

https://access.redhat.com/errata/RHSA-2026:7380

https://access.redhat.com/errata/RHSA-2026:7109

https://access.redhat.com/errata/RHSA-2026:34608

https://access.redhat.com/errata/RHSA-2026:22619

https://access.redhat.com/errata/RHSA-2026:18059

https://access.redhat.com/errata/RHSA-2026:18055

https://access.redhat.com/errata/RHSA-2026:18054

https://access.redhat.com/errata/RHSA-2026:17789

https://access.redhat.com/errata/RHSA-2026:17668

https://access.redhat.com/errata/RHSA-2026:14276

https://access.redhat.com/errata/RHSA-2026:14272

https://access.redhat.com/errata/RHSA-2026:13571

https://access.redhat.com/errata/RHSA-2026:10184

https://access.redhat.com/errata/RHSA-2026:10175

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS