Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2026-55831

HighPublic exploit

Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in DefaultSpdySettingsFrame, allowing a remote SPDY/3.1 peer to send a syntactically…

Published Jul 21, 2026 · Updated Oct 1, 2026 · Also known as DEBIAN-CVE-2026-55831, EUVD-2026-46132, GHSA-6jqx-86gh-f27w, ROOT-APP-MAVEN-CVE-2026-55831, UBUNTU-CVE-2026-55831

Key Facts

Patch immediately
  • CVE-2026-55831 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Netty, airbyte-server (chainguard), airbyte-server-fips (chainguard) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
  • EPSS estimates a 0.7% probability of exploitation in the next 30 days.
  • Fixed versions are available, including airbyte-server 2.0.0-r8, airbyte-server-fips 2.0.0-r10, akhq 0.27.1-r12.
  • Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (30-day exploit likelihood)

0.7%

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-55831 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in DefaultSpdySettingsFrame, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Affected Products

275 affected entries in total
ProductAffected versionsFixed in
NettyNetty>= 4.2.0.Final,4.1.136
airbyte-serverchainguardSee advisory2.0.0-r8
airbyte-server-fipschainguardSee advisory2.0.0-r10
akhqchainguardSee advisory0.27.1-r12
apache-activemq-artemischainguardSee advisory2.55.0-r1
20 more affected products in the full CVE brief

Patched Releases

airbyte-server

2.0.0-r8

airbyte-server-fips

2.0.0-r10

akhq

0.27.1-r12

apache-activemq-artemis

2.55.0-r1, 2.56.0-r0

apache-camel-karavan-devmode

4.18.1-r8

apache-druid

38.0.0-r0

apache-druid-fips

38.0.0-r0

apache-hop

2.18.1-r10, 2.19.0-r0

apache-hop-fips

2.18.1-r6, 2.19.0-r0

apache-iceberg-sink-connector

1.12.0-r0

apache-iceberg-sink-connector-fips

1.12.0-r0

apache-nifi

2.10.0-r6, 2.11.0-r0

apache-nifi-registry

2.11.0-r0

apache-polaris

1.7.0-r0

apache-polaris-admin-tool

1.7.0-r0

apache-polaris-admin-tool-fips

1.7.0-r0

apache-polaris-fips

1.7.0-r0

apache-pulsar-4.0

4.0.12-r2, 4.0.13-r0

apache-pulsar-4.1

4.1.3-r15

apache-pulsar-4.2

4.2.3-r3, 4.2.4-r0

apache-pulsar-fips-4.0

4.0.12-r2, 4.0.13-r0

apache-pulsar-fips-4.2

4.2.3-r2, 4.2.4-r0

apicurio-registry

3.3.0-r11, 3.3.2-r0

apicurio-registry-fips

3.3.0-r8, 3.3.2-r0

camunda-8.8

8.8.31-r2, 8.8.32-r0

Timeline

  1. Publicly disclosed

    Jul 21, 2026

  2. Last updated

    Oct 1, 2026

Weakness Type

  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-55831 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo