THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-56816 (HIGH 7.5) — Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLe

[NVD] CVE-2026-56816 (HIGH 7.5) — Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLe

mednvdPublished 2026-07-21

CVE-2026-56816 CVSS: 7.5 HIGH Published: 2026-07-21T22:17:14.803

Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC stre

Indicators of compromise

CVE-2026-56816cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-56816