CVE-2026-48043 Details
Description
Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
A memory exhaustion vulnerability has been identified in the Netty HTTP/2 codec, specifically in versions prior to 4.1.135.Final and 4.2.15.Final. The issue arises in the DelegatingDecompressorFrameListener class, which manages HTTP/2 decompression by using a per-stream EmbeddedChannel to apply the appropriate decompression codec (gzip, deflate, zstd) and forward the decompressed data to a wrapped listener. Each chunk is a pooled ByteBuf given to an anonymous ChannelInboundHandlerAdapter tail handler, which is responsible for releasing it. However, a remote peer can send frames that cause the flow-controller to throw an exception, leading to a resource leak that could eventually exhaust memory and cause the Java Virtual Machine to run out of memory.
Users can upgrade to Netty versions 4.1.135.Final or 4.2.15.Final to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-772 | Missing Release of Resource after Effective Lifetime | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| netty netty | < 4.1.135 >= 4.2.0, < 4.2.15 |
CPE
Remediation
| |
Change History
19 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | redhat-SADP |
| Sep 11, 2026 | CVE Modified | redhat-SADP |
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Sep 2, 2026 | CVE Modified | redhat-SADP |
| Sep 2, 2026 | CVE Modified | [email protected] |
| Aug 13, 2026 | CVE Modified | redhat-SADP |
| Aug 12, 2026 | CVE Modified | redhat-SADP |
| Aug 5, 2026 | CVE Modified | redhat-SADP |
| Jul 30, 2026 | CVE Modified | redhat-SADP |
| Jul 21, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 9, 2026 | CVE Modified | redhat-SADP |
| Jul 3, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 15, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | New CVE Received | [email protected] |