CVE-2026-56745¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Netty's SpdyHttpDecoder allocates a pooled ByteBuf when processing a client-initiated SYN_STREAM frame with FLAG_FIN=0 and stores the partially constructed FullHttpRequest in messageMap. When the remote peer sends RST_STREAM for that stream, or the accumulated content exceeds maxContentLength, the decoder removes the entry but does not release the pooled ByteBuf, causing native memory exhaustion. Fixed in 4.1.136.Final and 4.2.16.Final.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.3.0
WSO2 JUSTIFICATION¶
A single Netty distribution reaches the runtime in WSO2 Identity Server, shipped as a WSO2 orbit bundle that re-wraps an upstream release within the affected range. The vulnerable class is present and pre-fix - the shipped SpdyHttpDecoder still declares channelInactive(ChannelHandlerContext) rather than the handlerRemoved(ChannelHandlerContext) introduced by the fix - so this finding turns entirely on whether it is reachable.
The SPDY codec is never used. Nothing in the shipped distribution references any io.netty.handler.codec.spdy class; these classes appear only inside the Netty bundle itself. The bundles that do consume Netty are not even wired to that package.
No Netty HTTP server is ever started. io.netty.handler.codec.http.HttpServerCodec and io.netty.handler.codec.spdy.SpdyFrameCodec are referenced by nothing in the shipped distribution, so no Netty server pipeline is ever built. WSO2 Identity Server serves all inbound HTTP through embedded Apache Tomcat, configured in repository/conf/tomcat/catalina-server.xml.
The precondition the defect needs - a Netty pipeline running the SPDY-to-HTTP codec and receiving SPDY/3.1 SYN_STREAM and RST_STREAM frames from a remote peer - therefore does not exist in this product.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.