Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Netty HTTP/2 library can run out of memory

CVE-2026-48043 · published 4 months ago
Summary

The Netty HTTP/2 component used in several Linux distributions can leak memory when handling compressed data, eventually exhausting the server’s memory and causing it to stop. This occurs in versions before the latest updates. Upgrade Netty to the versions that include the fix or apply the provided patches to prevent the memory leak.

What to do
  • Update netty io.netty:netty-codec-http2 to version 4.1.135.Final.
  • Update netty io.netty:netty-codec-http2 to version 4.2.15.Final.
  • Update root io.root.io.netty:netty-codec-http2 to version 4.1.126.Final-root.io.21.
  • Update netty io.netty:netty-codec-http2 to version 4.1.126.Final-aikido.21.
  • Update root io.root.io.netty:netty-codec-http2 to version 4.1.118.Final-root.io.22.
  • Update netty io.netty:netty-codec-http2 to version 4.1.118.Final-aikido.22.
  • Update root io.root.io.netty:netty-codec-http2 to version 4.1.126.Final-root.io.22.
  • Update netty io.netty:netty-codec-http2 to version 4.1.126.Final-aikido.22.
  • Update io.netty:netty-codec-http2 to version 4.1.135.Final.
  • Update io.netty:netty-codec-http2 to version 4.2.15.Final.
  • Update io.netty:netty-codec-http2 to version 4.1.118.Final-aikido.24.
  • Update io.root.io.netty:netty-codec-http2 to version 4.1.118.Final-root.io.24.
  • Update io.netty:netty-codec-http2 to version 4.1.118.Final-aikido.26.
  • Update io.root.io.netty:netty-codec-http2 to version 4.1.118.Final-root.io.26.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian netty All versions
Debian:12 debian netty All versions
Debian:13 debian netty All versions
Debian:14 debian netty All versions
maven netty io.netty:netty-codec-http2 <= 4.1.134.Final
>= 4.2.0.Alpha1, <= 4.2.14.Final
Fix: upgrade to 4.1.135.Final
– netty netty < 4.1.135
>= 4.2.0, < 4.2.15
>= 4.2.0.Final, < 4.2.15.Final
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
Ubuntu:Pro:14.04:LTS canonical netty All versions
Ubuntu:Pro:16.04:LTS canonical netty All versions
Ubuntu:Pro:18.04:LTS canonical netty All versions
Ubuntu:Pro:20.04:LTS canonical netty All versions
Ubuntu:Pro:22.04:LTS canonical netty All versions
Ubuntu:Pro:24.04:LTS canonical netty All versions
Ubuntu:25.10 canonical netty All versions
Ubuntu:Pro:26.04:LTS canonical netty All versions
Root:Maven root io.root.io.netty:netty-codec-http2 < 4.1.126.Final-root.io.21
< 4.1.118.Final-root.io.22
< 4.1.126.Final-root.io.22
Fix: upgrade to 4.1.126.Final-root.io.21
Root:Maven netty io.netty:netty-codec-http2 < 4.1.126.Final-aikido.21
< 4.1.118.Final-aikido.22
< 4.1.126.Final-aikido.22
Fix: upgrade to 4.1.126.Final-aikido.21
maven – io.netty:netty-codec-http2 <= 4.1.134.Final
>= 4.2.0.Alpha1, <= 4.2.14.Final
Fix: upgrade to 4.1.135.Final
Root:Maven – io.netty:netty-codec-http2 < 4.1.118.Final-aikido.24
< 4.1.118.Final-aikido.26
Fix: upgrade to 4.1.118.Final-aikido.24
Root:Maven – io.root.io.netty:netty-codec-http2 < 4.1.118.Final-root.io.24
< 4.1.118.Final-root.io.26
Fix: upgrade to 4.1.118.Final-root.io.24
Maven – io.netty:netty-codec-http2 < 4.1.135.Final
>= 4.2.0.Alpha1, < 4.2.15.Final
Fix: upgrade to 4.1.135.Final
Original advisory text
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
CWE-401Memory Leak
CWE-772Missing Release of Resource after Effective Lifetime
Timeline
Published12 Jun 2026
Updated4 Nov 2026
First seen11 Jun 2026
Sources
DEBIAN-CVE-2026-48043 · OSV
UBUNTU-CVE-2026-48043 · OSV
ROOT-APP-MAVEN-CVE-2026-48043 · OSV
GHSA-c2gf-v879-257j · GHSA
CVE-2026-48043 · NVD
CVE-2026-48043 · MITRE
CVE-2026-48043 · OSV
GHSA-c2gf-v879-257j · OSV
Track software like this
Free during beta