Improper Handling of Highly Compressed Data (Data Amplification) Affecting io.netty:netty-codec package, versions [,4.1.133.Final)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-IONETTY-16438930
- published7 May 2026
- disclosed7 May 2026
- creditoffset
Introduced: 7 May 2026
NewCVE-2026-42587 (opens in a new tab)How to fix?
Upgrade io.netty:netty-codec to version 4.1.133.Final or higher.
Overview
io.netty:netty-codec is an event-driven asynchronous network application framework.
Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) in the HttpContentDecompressor and DelegatingDecompressorFrameListener components when the Content-Encoding header is set to br, zstd, or snappy. An attacker can exhaust system memory and cause a denial of service by sending a highly compressed payload that decompresses to a very large size, bypassing the configured decompression limit.