CVE-2026-48043 netty CVE debrief

Who should care

Defenders responsible for Netty-based applications should assess exposure and prioritize updates to patched versions. They should also monitor for unusual traffic patterns that could indicate exploitation attempts.

Why it matters

CVE-2026-48043 is a resource leak vulnerability in Netty's `DelegatingDecompressorFrameListener` class. Defenders should prioritize updates to patched versions and monitor for unusual traffic patterns. The vulnerability could lead to resource exhaustion and potential JVM crashes if exploited.

• Potential resource exhaustion due to uncontrolled resource consumption
• Possible JVM crash due to OutOfMemoryError (OOME)
• Need for verification of affected versions and inventory checks
• Priority for updating to patched versions of Netty

Technical summary

The `DelegatingDecompressorFrameListener` class in Netty's netty-codec-http2 module is vulnerable to a resource leak. A remote attacker could send frames that cause the flow-controller to throw, leading to a resource leak. This might result in the JVM crashing due to an OutOfMemoryError (OOME). The issue arises from the improper handling of pooled `ByteBuf` objects in the decompression process. Defenders should prioritize updating to patched versions of Netty, specifically 4.1.135.Final or 4.2.15.Final, to mitigate the resource leak vulnerability. They should also monitor for unusual traffic patterns that could be indicative of exploitation attempts and review the configuration of affected Netty-based  

Defensive priority

Defenders should prioritize updating to patched versions of Netty, specifically 4.1.135.Final or 4.2.15.Final, to mitigate the resource leak vulnerability. They should also monitor for unusual traffic patterns that could be indicative of exploitation attempts.

Recommended defensive actions

• Update to Netty version 4.1.135.Final or 4.2.15.Final
• Monitor for unusual traffic patterns
• Review and adjust resource allocation and monitoring
• Perform an inventory check of Netty-based applications to identify potential exposure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. Vendor advisories and release notes also offer guidance on patched versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.