Netty HTTP/2 Decompressor Memory Leak (OOM DoS) in netty-codec-http2

Vulnerability Overview HTTP/2 Decompression Leaks ByteBuf Reference Count, Resulting in Direct Memory Leak / OOM DoS When the Decompressor Channel is Closed Vulnerability Type: Uncontrolled Resource Consumption / Memory Leak (CWE-401) Severity: High (7.5 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Affected Versions Affected Versions: - (Maven) - >= 4.2.0, = 4.1.0.Final, <= 4.1.135.Final Fixed Versions: - 4.2.16.Final - 4.1.136.Final Remediation Recommended Fix: Track whether succeeds, and roll back the additional if the data does not enter the pipeline. Code Example: Proof of Concept (POC) Code Reproduction Steps: 1. Download the official artifact and its dependencies from Maven Central (version 4.2.15.Final). 2. Construct a real wrapping a real gzip decoder . 3. Close the internal decompressor channel (entering the cleanup state via / ). 4. Encode a real gzip data payload using ( ). 5. Call on the closed channel. 6. Observe: throws a in the check ( ), called from ; is now 2. 7. Release once; the frame reader will have: remaining at 1 ( returns ) — leak. Observed Reference Count Tracking: Observed Exception Stack Trace (Confirming Leak Point): Impact Vulnerability Type: Uncontrolled Resource Consumption / Memory Leak (CWE-401), leading to Denial of Service. Each forged data frame leaks one direct buffer (typically off-heap) ByteBuf. Who is Affected: Any server (or client) that enables HTTP/2 content decompression by installing in their HTTP/2 pipeline. Attacker Requirements: Remote, unauthenticated. The attacker only needs to send HTTP/2 data frames to a decompressor that has already been cleaned up (e.g., sending data after ). No special server configuration is required to enable decompression. Result: Continuous triggering on long-lived connections will exhaust direct memory and cause the JVM to crash with an .

Goal Reached Thanks to every supporter — we hit 100%!

Netty HTTP/2 Decompressor Memory Leak (OOM DoS) in netty-codec-http2

More from this source