CVE-2026-44248: Netty Replaying Decoder Readablebytes Doscve-2026-44248-netty-replaying-decoder-readablebytes-dos
A ReplayingDecoder checks the currently available `readableBytes()` against a maximum limit inside a `Signal` catch block, rather than the message's declared size. An attacker can send an oversized message in small chunks, bypassing early rejection. The decoder will repeatedly re-parse the growing buffer, causing severe CPU and memory exhaustion. Compare aga