CVE-2026-33871

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 8.7EPSS 1%

Published 2026-03-27Updated 2026-03-27

Vulnerability details

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CNAGitHub_M

EPSS score history

Sources

4 links

PoC links are not available for guest users. Login to view them.

CVE Organization NVD Analysis RedHat Vuln DB The Hacker News

Profile

CVSS

8.7

EPSS

Published

2026-03-27

Updated

2026-03-27

CNA

GitHub_M

Vendors

netty

1 product

CPEs

cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8

cpe:/a:redhat:cryostat:4::el9

cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9

cpe:/a:redhat:amq_broker:7.12

cpe:/a:redhat:amq_broker:7.13

cpe:/a:redhat:amq_broker:7.14

cpe:/a:redhat:apache_camel_quarkus:3.27

cpe:/a:redhat:jboss_data_grid:8

cpe:/a:redhat:openshift_ai:2.25::el9

cpe:/a:redhat:openshift_devspaces:3.27::el9

cpe:/a:redhat:apache_camel_spring_boot:4.18

cpe:/a:redhat:quarkus:3.20::el8

cpe:/a:redhat:quarkus:3.27::el8

cpe:/a:redhat:amq_streams:3.2::el9

cpe:/a:redhat:cryostat:4

cpe:/a:redhat:logging:5

cpe:/a:redhat:serverless:1

cpe:/a:redhat:amq_clients:2023

cpe:/a:redhat:apache_camel_hawtio:4

cpe:/a:redhat:camel_quarkus:3

cpe:/a:redhat:service_registry:2

cpe:/a:redhat:apicurio_registry:3

cpe:/a:redhat:debezium:2

cpe:/a:redhat:debezium:3

cpe:/a:redhat:build_keycloak:

cpe:/a:redhat:optaplanner:::el6

cpe:/a:redhat:quarkus:3

cpe:/a:redhat:enterprise_linux_ai:3

cpe:/a:redhat:jboss_fuse:7

cpe:/a:redhat:jboss_enterprise_application_platform:7

cpe:/a:redhat:jbosseapxp

cpe:/a:redhat:openshift_ai

cpe:/a:redhat:jboss_enterprise_bpms_platform:7

cpe:/a:redhat:red_hat_single_sign_on:7

cpe:/a:redhat:amq_streams:2

cpe:/a:redhat:jboss_enterprise_application_platform:8

cpe:/a:redhat:satellite:6

cpe:/a:redhat:amq_streams:3

cpe:/a:redhat:amq_streams:2.9::el9

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated