CVE-2026-48043: netty Uncontrolled Resource Consumption

Vulnerability summary

CVE-2026-48043 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in netty. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.4% of scored vulnerabilities.

Timeline

1. 12-06-2026
   PublishedVulnerability first disclosed.
2. 18-09-2026
   Last modifiedVulnerability information updated.

Description

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

• CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
• CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
• CWE-772Missing Release of Resource after Effective LifetimeThe product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.