CVE-2026-33871: DoS on Netty HTTP/2 via CONTINUATION flood

CVE-2026-33871 is a Denial of Service affecting Netty, the asynchronous network framework widely used in Java enterprise applications. The vulnerability resides in the HTTP/2 handler and is triggered by a flood of CONTINUATION frames sent by a remote attacker. Without a frame count limit, the attacker can bypass size-based protections using zero-byte frames, causing excessive CPU consumption and service unavailability.

With CVSS 7.5 (HIGH classification), this vulnerability has significant operational impact on production HTTP/2 servers. The patch was released in March 2026 in versions 4.1.132.Final and 4.2.10.Final. A signal from GitHub repositories emerged on November 6, 2026, suggesting sustained technical interest in the vulnerability. No confirmed public exploits are reported, but the minimal CPU consumption required to trigger DoS represents a concrete risk.

Sysadmins must immediately verify which Netty versions are deployed in their systems, especially for exposed HTTP/2 services. Updates to patched versions must be prioritized. Meanwhile, monitor inbound HTTP/2 traffic for anomalous CONTINUATION frame patterns; implement frame rate limiting at WAF or reverse proxy level if available. Test patches in staging before production deployment to ensure compatibility with dependent applications.