Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 1 advisory

CVE-2026-56745

CVE-2026-56745: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-56745] Denial of Service via memory exhaustion in SPDY-to-HTTP codec

    CVE-2026-56745Source published Source updated

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A flaw was found in Netty. This oversight leads to native memory exhaustion, which can result in a Denial of…

    Affected products in this advisory
    • Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16
    • Red Hat Build of Apache Camel 4.18 for Quarkus 3.33
    • Red Hat build of Quarkus 3.27.4.SP3
    • Red Hat build of Quarkus 3.33.2.SP3

    19 more entries in the full advisory.

    Source-reported affected versions
    • 4.2.0
    • 4.2.15
    • 4.1.0
    • 4.1.135
    Source-reported fixed versions
    • 4.1.136
    • 4.2.16
    • netty-codec-http
    • devspaces/openvsx-rhel9:1787759145

    7 more entries in the full advisory.

    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features