Summary

A remote, unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed, Http2Decompressor.decompress(...) retains the frame buffer but never releases it on the error path, so its reference count never returns to zero. Repeating this over a long-lived HTTP/2 connection exhausts direct memory and crashes the JVM with OutOfMemoryError — a denial of service.

Details

In codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java, Http2Decompressor.decompress(...) does:

// around line 433
decompressor.writeInbound(data.retain());

The argument data.retain() is evaluated before writeInbound(...) executes, incrementing the buffer's reference count (refCnt: 1 -> 2). The very first statement of EmbeddedChannel.writeInbound(...) is ensureOpen() (EmbeddedChannel.java:360), which throws ClosedChannelException when the decompressor's internal EmbeddedChannel has already been closed.

When that happens: - the DATA payload has been retain()ed but never entered the pipeline, so the decoder's finally { release() } never runs; - the surrounding catch (Throwable t) block in decompress(...) (around line 451) does not release the extra reference; - the input buffer therefore can never reach refCnt 0, and its (typically direct) memory is leaked.

The decompressor channel is closed on a reachable path: Http2Connection onStreamRemoved → Http2Decompressor.cleanup() → EmbeddedChannel.finishAndReleaseAll() (DelegatingDecompressorFrameListener.java:125-133 and 418-420).

A peer that sends DATA frames for a stream whose decompressor has already been cleaned up (e.g. continuing to send DATA after END_STREAM / stream removal) thus leaks one direct ByteBuf per frame.

Affected code: DelegatingDecompressorFrameListener.java, method Http2Decompressor.decompress(...) — the decompressor.writeInbound(data.retain()) call (line ~433) and its catch (Throwable t) block (line ~451), which lacks a data.release() rollback.

Suggested fix: track whether writeInbound succeeded and roll back the extra retain() only when the data never entered the pipeline:

boolean writeSucceeded = false;
try {
    decompressor.writeInbound(data.retain());
    writeSucceeded = true;            // pipeline now owns the release
    if (endOfStream) {
        decompressor.finish();
    }
    return 0;
} catch (Throwable t) {
    if (!writeSucceeded) {
        data.release();               // roll back the extra retain(); data never entered pipeline
    }
    if (t instanceof Http2Exception) {
        throw (Http2Exception) t;
    }
    throw streamError(stream.id(), INTERNAL_ERROR, t, ...);
}

PoC

Reproduced against the official, unmodified netty-codec-http2-4.2.15.Final.jar from Maven Central, using real netty classes and measuring ByteBuf.refCnt() directly (the leaking logic is not mocked).

Reproduction steps:

1. Download the official artifacts and their dependencies from Maven Central (version 4.2.15.Final): netty-common, netty-buffer, netty-transport, netty-resolver, netty-handler, netty-codec-base, netty-codec, netty-codec-http, netty-codec-http2, netty-codec-compression.
2. Build a real Http2Decompressor wrapping a real gzip decoder EmbeddedChannel (ZlibCodecFactory.newZlibDecoder(ZlibWrapper.GZIP)).
3. Close the internal decompressor channel (equivalent to the end state of cleanup() / finishAndReleaseAll()).
4. Encode a real gzip DATA payload with ZlibCodecFactory.newZlibEncoder(GZIP) (refCnt = 1).
5. Call decompress(...) on the closed channel.
6. Observe: writeInbound(...) throws ClosedChannelException at its ensureOpen() entry (EmbeddedChannel.java:360), reached from DelegatingDecompressorFrameListener.java:433; data.refCnt() is now 2.
7. Release once as the frame reader would; refCnt stays at 1 (release() returns false) → leaked.

Observed reference-count trace:

gzipData initial refCnt = 1
decompress -> data.retain()        -> refCnt = 2   (retain applied, never rolled back)
caller releases once               -> refCnt = 1   (release() returns false; not deallocated)
=> buffer never reaches 0 -> direct memory leaked

Observed exception stack (confirms the leak point):

java.nio.channels.ClosedChannelException
    at io.netty.channel.embedded.EmbeddedChannel.checkOpen(EmbeddedChannel.java:959)
    at io.netty.channel.embedded.EmbeddedChannel.ensureOpen(EmbeddedChannel.java:979)
    at io.netty.channel.embedded.EmbeddedChannel.writeInbound(EmbeddedChannel.java:360)
    at io.netty.handler.codec.http2.DelegatingDecompressorFrameListener$Http2Decompressor
            .decompress(DelegatingDecompressorFrameListener.java:433)

Two notes on the harness (they do not affect the leak mechanism): - The internal channel is closed directly via close() rather than through cleanup(). The end state is identical (channel closed → writeInbound throws at ensureOpen()); the bug depends on "channel closed → retain not rolled back", not on how the channel was closed. - In the isolated harness the rethrown StreamException's root cause shows as NullPointerException because the harness does not initialise an Http2LocalFlowController (a secondary exception reported during channel close). The leak is already sealed at the ClosedChannelException thrown by writeInbound's ensureOpen() (line 360); in a real server with the flow controller initialised, the triggering exception is the ClosedChannelException itself.

A complete self-contained PoC (Verify02DecompressLeak.java, ~150 lines, no test framework) plus the exact javac / java commands can be attached on request.

Impact

• Vulnerability type: uncontrolled resource consumption / memory leak (CWE-401), leading to denial of service. Each crafted DATA frame leaks one (typically direct/off-heap) ByteBuf.
• Who is impacted: any server (or client) that enables HTTP/2 content decompression by installing DelegatingDecompressorFrameListener in its HTTP/2 pipeline.
• Attacker requirements: remote, unauthenticated. The attacker only needs to send HTTP/2 DATA frames for a stream whose decompressor has been cleaned up (e.g. continue sending DATA after END_STREAM). No special server configuration beyond decompression being enabled.
• Result: sustained triggering over a long-lived connection exhausts direct memory and crashes the JVM with OutOfMemoryError.

Multiple versions of the Node.js minimist module contain a prototype pollution vulnerability in the setKey() function, enabling remote code execution and uncontrolled resource consumption, affecting various products including NetApp and several Node.js updates.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the minimatch package's braceExpand function, affecting multiple dependent products including Catboost, Dash-extensions, and Jnitrace, which have updated to minimatch version 3.1.2 to address the issue.

Babel versions prior to 7.23.2 and related plugins are vulnerable to arbitrary code execution via the internal methods path.evaluate() and path.evaluateTruthy() when compiling attacker-crafted code.

A vulnerability in the BC-JAVA library's GOST 28147-2015 CTR mode causes keystream reuse after 255 blocks, affecting multiple versions and IBM Db2 Server, enabling attackers to compromise data confidentiality.

A second-order SQL injection vulnerability in Hibernate ORM versions 5.2.8 to 5.6.15, affecting Red Hat and NetApp products, allows remote attackers with low privileges to exploit unsanitized non-alphanumeric characters, risking data disclosure and manipulation.

Eclipse Jetty's HTTP/1.1 parser improperly handles unclosed quoted strings in chunked transfer encoding extensions, enabling request smuggling attacks that can bypass security controls and lead to cache poisoning, access control bypass, and session hijacking.

A resource allocation vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg before version 1.84 allows unauthenticated attackers to cause memory exhaustion and denial of service via unbounded PGP AEAD chunk sizes.

Multiple lodash vulnerabilities, including CVE-2021-23337 and command injection in _.template, affect various versions and Oracle products, enabling code injection and remote takeover with severity up to CVSS 9.8, fixed in lodash 4.18.0 and later.

fast-uri versions 3.1.0 and earlier improperly decode percent-encoded path separators and dot segments before normalization, causing distinct URIs to collapse into the same path and enabling bypass of path-based security policies.

fast-uri versions up to 3.1.1 improperly decode percent-encoded authority delimiters in the host component, altering URI structure and enabling redirection to unintended hosts.

Eclipse Jetty's DigestAuthentication improperly uses ISO-8859-1 encoding for password hashing, causing non-Latin-1 characters to be replaced with '?', enabling attackers to bypass authentication via hash collisions and impersonation.

The form-data library up to version 4.0.5 is vulnerable to CRLF injection due to unescaped carriage return, line feed, and double-quote characters in multipart field names and filenames, fixed in versions 2.5.6, 3.0.5, and 4.0.6 by escaping these characters.

Multiple Node.js updates address a denial of service vulnerability in the undici WebSocket client caused by unbounded memory growth from numerous small or empty continuation frames, alongside other critical security fixes.

Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability in CMS AuthEnvelopedData where tag-length enforcement fails during decryption, potentially compromising data integrity.

Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 contain a vulnerability in KCCMBlockCipher MAC where nonce binding fails without AAD, enabling cross-nonce AEAD forgery attacks.

Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 are vulnerable to IESEngine stream-mode MAC forgery due to a length-dependent key derivation function split issue.

brace-expansion versions through 5.0.6 have a denial of service vulnerability due to the expand() function's exponential-time complexity when processing consecutive non-expanding brace groups, causing high CPU usage and event-loop blocking.

Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where lazy ASN.1 sequence forcing resets the nesting-depth guard, potentially compromising security controls.

fast-uri versions 2.3.1 through 4.0.0 fail to properly canonicalize Unicode/IDN hostnames in HTTP URLs, causing discrepancies with Node's URL parser that can be exploited to bypass host-based security policies.

brace-expansion versions through 5.0.7 contain a denial of service vulnerability due to unbounded string length in the expand() function, leading to memory exhaustion and fixed in version 5.0.8 by adding a maxLength limit.

Bouncy Castle for Java versions prior to 1.85, including certain LTS, FIPS, and bctls-fips versions, contains a vulnerability that can cause out-of-memory errors due to unbounded memory allocation during definite-length reads.

fast-uri versions 2.3.1 to 4.1.0 improperly handle backslashes in URLs, causing host parsing inconsistencies with Node's WHATWG URL parser that can lead to security bypasses, requiring upgrades to fixed versions.

fast-uri versions prior to 4.1.2, 3.1.5, and 2.4.4 improperly parse URIs with backslashes instead of double forward slashes, causing discrepancies with Node's WHATWG URL parser and enabling host-based security policy bypasses.

A critical Broken Authentication & Session Management vulnerability (CVE-2026-21582) in Atlassian Crowd Data Center 7.2.1 enables unauthenticated attackers to impersonate other users.

Multiple Apache Tomcat and Apache Tomcat Native versions contain an improper input validation vulnerability in OCSP response handling that allows bypassing certificate revocation checks, with additional critical flaws affecting related products like Oracle Siebel CRM and SAP Commerce Cloud.

Multiple vulnerabilities in axios versions prior to 0.30.3 and 1.13.5 cause denial of service via mergeConfig crashing on configuration objects containing __proto__, alongside various security issues in HPE and Oracle products.

Underscore.js versions up to 1.13.7 and Oracle Commerce Platform 11.4.0 contain vulnerabilities causing denial of service via stack overflow or application hang through recursive data processing or business control center flaws, while HPE UOCAM suffers from multiple security issues including path traversal and resource overconsumption.

Rollup versions prior to 2.80.0, 3.30.0, and 4.59.0 contain a high-severity arbitrary file write vulnerability via path traversal due to improper filename sanitization, enabling attackers to overwrite files and potentially execute remote code.

Node-tar versions prior to 7.5.10 contain a vulnerability allowing crafted archives to create hardlinks with drive-relative link targets on Windows, enabling path traversal and file overwrite outside the extraction directory.

Micrometer versions 1.15.0 to 1.15.11 and 1.16.0 to 1.16.5 contain a vulnerability where specially crafted gRPC requests can trigger a denial-of-service (DoS) condition, impacting system availability.

Micrometer versions 1.9.0 through 1.16.5, including micrometer-core and micrometer-jetty, are vulnerable to specially crafted HTTP requests that can cause a denial-of-service (DoS) condition, impacting system availability.

Apache Tomcat versions 9.0.0.M1 to 11.0.21 have multiple vulnerabilities including unbounded WebDAV request bodies, HTTP/2 header validation flaws, WebSocket authentication exposure, and authorization bypass, leading to denial of service, crashes, and credential exposure.

Spring Framework versions used in Spring MVC and WebFlux applications are vulnerable to DoS attacks during static resource resolution, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a remotely exploitable vulnerability allowing system takeover, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.

Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications products, including a JavaScript escaping flaw enabling XSS, a difficult-to-exploit remote takeover in BRM Elastic Charging Engine, and a non-exploitable security-in-depth issue in Management Cloud Engine.

Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0, including an Algorithmic DoS and a difficult-to-exploit remote takeover vulnerability.

Certain Spring Framework versions are vulnerable to DoS via unbounded cache growth from user-supplied SpEL expressions, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a difficult-to-exploit unauthenticated HTTP takeover vulnerability, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.

The uuid library versions prior to 14.0.0 have a vulnerability in v3, v5, and v6 UUID functions where missing buffer bounds checks allow silent partial or out-of-range writes to caller-provided buffers, potentially causing malformed UUIDs.

Axios versions prior to 1.15.1 and 0.31.1 are vulnerable to prototype pollution attacks that enable attackers to intercept, modify JSON responses, or hijack HTTP requests and responses via polluted configuration properties.

Axios versions prior to 1.15.1 and 0.31.1 contain a prototype pollution vulnerability in the HTTP adapter that allows attackers to inject arbitrary HTTP headers into outgoing requests by exploiting polluted Object.prototype properties.

Axios versions prior to 1.15.1 and 0.31.1 contain a high-severity Prototype Pollution vulnerability in the validateStatus property merge strategy that allows attackers to bypass authentication and error handling by treating all HTTP error responses as successful.

pgjdbc versions 42.2.0 to before 42.7.11 are vulnerable to client-side denial of service via excessive CPU usage during SCRAM-SHA-256 authentication, fixed in 42.7.11, while Oracle Communications Cloud Native Core Console versions 25.1.203 and 25.2.201 have a network-accessible SQL injection denial of service vulnerability.

Multiple vulnerabilities in Apache Netty prior to versions 4.1.133.Final and 4.2.13.Final allow remote attackers to cause excessive memory allocation, denial of service, and potential data compromise via crafted LZ4 compressed data and HTTP/2 requests.

Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstandard, and Snappy encodings, causing out-of-memory denial of service.

Apache Tomcat versions 7.0.0 to 11.0.21 contain multiple security vulnerabilities including LockOutRealm case sensitivity issues, digest authentication bypass, WebDAV request size DoS, HTTP/2 header validation flaws, WebSocket authentication exposure, and AJP secret comparison weaknesses.

Netty versions prior to 4.1.135.Final and 4.2.15.Final contain an IPv6 subnet bypass vulnerability in IpSubnetFilterRule.compareTo() due to incorrect masking, allowing unauthorized access control bypass.

Axios Node.js HTTP adapter versions prior to 0.32.0 and 1.16.0 can leak proxy credentials via stale Proxy-Authorization headers when following redirects from proxied to non-proxied targets, exposing sensitive authentication data.

Axios versions prior to 0.32.0 and 1.16.0 have a vulnerability in the Node.js HTTP adapter where Proxy-Authorization headers may be forwarded to redirected origins during proxy-to-direct redirect flows, risking exposure of sensitive proxy credentials.

Axios versions 1.7.0 through 1.15.x failed to enforce configured request and response size limits when using the fetch adapter, allowing oversized bodies that can cause resource exhaustion in server-side applications.

Axios versions prior to 1.16.0, including 1.15.2 and earlier, are vulnerable to prototype pollution that enables arbitrary HTTP header injection, sensitive data leakage, and denial-of-service crashes due to unsafe merging of object properties.

Axios versions prior to 0.32.0 and 1.16.0 contain a vulnerability where IPv4-mapped IPv6 addresses are not normalized in the shouldBypassProxy function, allowing NO_PROXY restrictions to be bypassed and requests to be routed through proxies improperly.

Axios versions 1.0.0 to before 1.16.0 contain a Prototype Pollution gadget in `config.proxy` that escalates Object.prototype pollution into a full Man-in-the-Middle attack, enabling interception and modification of all HTTP traffic including credentials.

Axios versions prior to 0.31.1 and 1.15.2 contain prototype-pollution gadgets in request config processing that can be exploited via a polluted Object.prototype.transformResponse from another vulnerability, enabling credential theft, response hijacking, or denial-of-service.

Axios versions before 0.32.0 and 1.16.0 have a vulnerability where unescaped regex metacharacters in the XSRF cookie name cause excessive regex backtracking, leading to client-side denial of service by freezing the browser tab.

Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a critical vulnerability in SslClientHelloHandler.decode() that causes unbounded memory allocation from crafted TLS ClientHello messages, leading to potential denial of service.

PostCSS versions up to 8.5.11 contain a vulnerability where attacker-controlled sourceMappingURL comments in CSS enable arbitrary local file reads, partial content disclosure, file-existence oracle, and potential denial of service.

The js-cookie library's assign() function was vulnerable to prototype pollution via JSON objects containing a __proto__ property, allowing attackers to manipulate cookie attributes such as domain, secure, and samesite.

Spring Security versions 5.7.0 to 5.7.24, 5.8.0 to 5.8.26, 6.3.0 to 6.3.17, 6.4.0 to 6.4.17, and 6.5.0 to 6.5.10 contain a vulnerability in the deprecated SubjectDnX509PrincipalExtractor that improperly handles malformed X.509 certificate CN values, enabling potential user impersonation.