PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45536 netty CVE debrief

CVE-2026-45536 is a MEDIUM severity vulnerability in Netty, a network application framework. The vulnerability occurs in the netty_unix_socket_recvFd function, where a peer-sent SCM_RIGHTS cmsg carrying two ints can cause a file descriptor leak. This happens when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default) via Epoll/KQueue DomainSocketChannel. The issue is patched in versions 4.1.135.Final and 4.2.15.Final.

Vendor
netty
Product
Unknown
CVSS
MEDIUM 4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-12
Original CVE updated
2026-06-15
Advisory published
2026-06-12
Advisory updated
2026-06-15

Who should care

Users of Netty versions prior to 4.1.135.Final and 4.2.15.Final who utilize Epoll/KQueue DomainSocketChannel with DomainSocketReadMode.FILE_DESCRIPTORS enabled.

Technical summary

The netty_unix_socket_recvFd function sets msg_control to a buffer of size 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has a length that fits exactly in this buffer, causing the kernel to install both fds in the receiving process. However, the subsequent check for cmsg_len fails, skipping the branch that would read the fd, and neither installed fd is closed. This results in two leaked fds per message.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade to Netty version 4.1.135.Final or 4.2.15.Final or later.
  • Avoid using DomainSocketReadMode.FILE_DESCRIPTORS with Epoll/KQueue DomainSocketChannel if possible.

Evidence notes

The vulnerability is reachable via Epoll/KQueue DomainSocketChannel when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS. Versions 4.1.135.Final and 4.2.15.Final patch the issue. [ref-4], [ref-5], [ref-6]

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45536 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45536

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45536 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45536

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.