ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33871

Netty is an asynchronous, event-driven network application framework.

Published Mar 27, 2026 · updated Sep 14, 2026 · netty netty

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of frames. The server's lack of a limit on the number of frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 27, 2026 · NIST NVD

    Detected

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of frames. The server's lack of a limit on the number of frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause exces

  2. Sep 14, 2026 · NIST NVD

    Updated

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of frames. The server's lack of a limit on the number of frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause exces

Affected

  • cpe netty/nettyversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33871

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33871

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of frames. The server's lack of a limit o

    nvd.nist.gov

References