CVE-2026-48006 netty CVE debrief

Who should care

Defenders responsible for Netty deployments, especially those using Redis pipeline connections, should assess exposure and prioritize patching or mitigation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review the affected scope, severity, and vendor guidance to validate exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-48006 is a high-severity vulnerability in Netty that can lead to DoS attacks due to memory leaks. Defenders should prioritize patching or mitigation, especially in environments with Redis pipeline connections.

• Denial-of-service (DoS) attacks are possible due to memory leaks
• Repeated connection churn can drain the JVM-wide direct-memory pool
• Allocation failures can occur on all Netty channels in the process
• Verification of affected versions and exposure is necessary

Technical summary

The RedisArrayAggregator handler in Netty leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. This issue affects Netty versions before 4.1.135.Final and 4.2.15.Final. The vulnerability can lead to DoS attacks due to memory leaks, and repeated connection churn can drain the JVM-wide direct-memory pool, causing allocation failures on all Netty channels in the process. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Netty is used with Redis pipeline connections.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Netty is used with Redis pipeline connections.

Recommended defensive actions

• Patch Netty to version 4.1.135.Final or 4.2.15.Final
• Mitigate the vulnerability by limiting Redis pipeline connections
• Monitor Netty usage and detect potential DoS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. Vendor advisories and release notes are also available. The vulnerability has a high CVSS score of 8.7 and is classified as HIGH severity. The CVE record was published on 2026-06-12T16:16:30.450Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.