CVE-2026-55831¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materialises every unique setting ID, allowing a remote SPDY/3.1 peer to send a syntactically valid oversized SETTINGS frame that creates a very large number of map entries and amplifies network input into heap growth and ordered-map insertion work. Fixed in 4.1.136.Final and 4.2.16.Final.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
A single Netty distribution reaches the runtime in WSO2 Identity Server, shipped as a WSO2 orbit bundle that re-wraps an upstream release within the affected range. The vulnerable class is therefore physically present, and this finding turns entirely on whether it is reachable.
The SPDY codec is never used. Nothing in the shipped distribution references any io.netty.handler.codec.spdy class, including SpdyFrameDecoder; these classes appear only inside the Netty bundle itself. A Netty pipeline containing SpdyFrameCodec reachable by a remote SPDY/3.1 peer does not exist in this product.
No Netty HTTP server is ever started. io.netty.handler.codec.http.HttpServerCodec and io.netty.handler.codec.spdy.SpdyFrameCodec are referenced by nothing in the shipped distribution, so no Netty server pipeline is ever built. WSO2 Identity Server serves all inbound HTTP through embedded Apache Tomcat, configured in repository/conf/tomcat/catalina-server.xml.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.