CVE-2026-33871: 
Java vulnerability analysis and mitigation

CVE-2026-33871 is an HTTP/2 CONTINUATION Frame Flood Denial of Service vulnerability in the Netty asynchronous network application framework. A remote, unauthenticated attacker can send a flood of HTTP/2 CONTINUATION frames with zero-byte payloads to exhaust server CPU resources and render the service unresponsive. The vulnerability affects Netty versions prior to 4.1.132.Final and 4.2.0.Alpha1 through versions prior to 4.2.10.Final (with the fix backported to 4.2.11.Final and 4.2.12.Final). It was published on March 24, 2026, and carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Netty Security Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerability resides in DefaultHttp2FrameReader.java within the io.netty:netty-codec-http2 package. When an HTTP/2 HEADERS frame is received without the END_HEADERS flag set, the server awaits subsequent CONTINUATION frames; however, the verifyContinuationFrame() method performs stream association checks but imposes no limit on the count of such frames. Additionally, the existing maxHeaderListSize size-based mitigation is bypassed because the byte-limit check (maxHeaderListSizeGoAway - len < headerBlock.readableBytes()) evaluates to false when len=0, meaning zero-byte CONTINUATION frames never trigger the guard. An attacker can thus monopolize a CPU thread and connection with minimal bandwidth by continuously sending zero-byte CONTINUATION frames (GitHub Advisory, Netty Security Advisory).

Successful exploitation results in a CPU-based Denial of Service, causing the targeted Netty HTTP/2 server to become unresponsive and blocking legitimate users from accessing the service. There is no confidentiality or integrity impact — the attack is purely an availability concern. The low bandwidth requirement makes the attack highly practical and scalable, and the broad adoption of Netty as a foundational networking library means the impact extends to numerous downstream products including IBM Maximo Application Suite, IBM API Connect, IBM Guardium Data Security Center, IBM Process Mining, Keycloak, Splunk, Red Hat Quarkus, and others (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing services running Netty HTTP/2 (versions < 4.1.132.Final or 4.2.0.Alpha1–4.2.9.Final) using tools such as Shodan or Censys, searching for HTTP/2-enabled endpoints built on Java/Netty.
2. Establish HTTP/2 connection: Open a standard HTTP/2 connection to the target server (no authentication required).
3. Send HEADERS frame without END_HEADERS: Transmit an HTTP/2 HEADERS frame on a valid stream ID with the END_HEADERS flag deliberately omitted, signaling to the server that CONTINUATION frames will follow.
4. Flood with zero-byte CONTINUATION frames: Continuously send HTTP/2 CONTINUATION frames with a zero-byte payload. Because verifyContinuationFrame() imposes no count limit and the maxHeaderListSize check is bypassed by zero-length payloads, the server processes each frame without terminating the sequence.
5. Exhaust CPU resources: The server's CPU thread is consumed processing the unbounded frame stream, monopolizing the connection and rendering the server unresponsive to legitimate requests (Netty Security Advisory, GitHub Advisory).

• Network: Sustained HTTP/2 connections from a single or small set of source IPs sending large volumes of CONTINUATION frames with zero-byte payloads; unusually high frame counts per connection with minimal data transfer volume.
• Logs: Application or access logs showing long-lived HTTP/2 connections that never complete a request/response cycle; repeated or stalled stream IDs in HTTP/2 server logs.
• Process/System: Sudden spike in CPU utilization on the Java process hosting the Netty HTTP/2 server without a corresponding increase in legitimate traffic or business activity; server threads blocked in DefaultHttp2FrameReader processing loops.
• Availability: Increased error rates or timeouts for legitimate clients connecting to the affected HTTP/2 service, consistent with resource exhaustion (Netty Security Advisory).

Upgrade Netty to version 4.1.132.Final or later (for the 4.1.x branch) or 4.2.11.Final / 4.2.12.Final or later (for the 4.2.x branch), which enforce a limit on the number of CONTINUATION frames (GitHub Advisory, Netty Security Advisory). Downstream product users should consult vendor-specific bulletins: IBM has issued patches for Maximo Application Suite, API Connect, Guardium Data Security Center, Process Mining, SPSS Analytic Server, Instana Observability, QRadar EDR, and DevOps Solution Workbench (IBM Bulletins). Red Hat has issued errata (e.g., RHSA-2026:7109, RHSA-2026:8159, RHSA-2026:8509) for affected products. As a temporary network-level workaround, consider placing a reverse proxy or WAF in front of Netty HTTP/2 services that can enforce connection and frame rate limits.

The vulnerability received coverage from cybersecurity news outlets including CyberSecurityNews and Security Boulevard, primarily in the context of Atlassian's April 2026 security bulletin which referenced the Netty flaw among multiple patched issues (Atlassian Bulletin). The Hacker News weekly recap for late April 2026 included mention of the vulnerability. The OpenSearch project community discussed the issue in their forums and addressed it in the OpenSearch 3.6.0 release. Multiple IBM product teams issued security bulletins throughout April–June 2026, reflecting the broad downstream impact of the Netty dependency. No significant controversy or researcher debate has been noted beyond standard patch-urgency discussions.