Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory exhaustion and denial of service. This issue is fixed in version 4.2.16.Final.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. Prior to
    4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the
    wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker
    to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory
    exhaustion and denial of service. This issue is fixed in version 4.2.16.Final. (CVE-2026-56816)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. Prior to     4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the     wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker     to open multiple QUIC streams and send reserved frames with very large payload lengths to cause memory     exhaustion and denial of service. This issue is fixed in version 4.2.16.Final. (CVE-2026-56816)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
462759	Echo: io.netty:netty-codec-http3: security update to 4.2.16.Final	Tenable Cloud Security	Echo Local Security Checks	Local	high
462759	Echo: io.netty:netty-codec-http3: security update to 4.2.16.Final	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
329600	Linux Distros Unpatched Vulnerability : CVE-2026-56816	Nessus	Misc.	Local	high
445204	SCA: security update for io.netty:netty-codec-http3 (GHSA-hpcc-26xq-25fv)	Tenable Cloud Security	SCA Checks	Local	high
445204	SCA: security update for io.netty:netty-codec-http3 (GHSA-hpcc-26xq-25fv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-56816

high

Tenable Plugins

high

high

high

high

high