netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
Priority MEDIUM 40CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 22 fixed, 11 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00753 55th percentileScored 2026-11-07
Fix Partial netty (netty): 4.2.15.Final, 4.1.135.Finalio.netty:netty-codec-http2 (Maven): 4.1.135.Final, 4.2.15.FinalRed Hat: 25 advisoriesRed Hat: 22 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| netty | netty | 4.2.0.Final to before 4.2.15.Final; before 4.1.135.Final | 4.2.15.Final, 4.1.135.Final | Patch available | CNA |
| — | io.netty:netty-codec-http2 (Maven) | before 4.1.135.Final | 4.1.135.Final | Patch available | GHSA-c2gf-v879-257j |
| — | io.netty:netty-codec-http2 (Maven) | 4.2.0.Alpha1 to before 4.2.15.Final | 4.2.15.Final | Patch available | GHSA-c2gf-v879-257j |
- netty Vendornetty Affected 4.2.0.Final to before 4.2.15.Final; before 4.1.135.Final Fixed in 4.2.15.Final, 4.1.135.Final Patch available CNA
- io.netty:netty-codec-http2 (Maven) Vendor— Affected before 4.1.135.Final Fixed in 4.1.135.Final Patch available GHSA-c2gf-v879-257j
- io.netty:netty-codec-http2 (Maven) Vendor— Affected 4.2.0.Alpha1 to before 4.2.15.Final Fixed in 4.2.15.Final Patch available GHSA-c2gf-v879-257j
Remediation
- Fix · CNA netty (netty) Fixed in 4.2.15.Final, 4.1.135.Final
- Fix · GHSA-c2gf-v879-257j io.netty:netty-codec-http2 (Maven) Fixed in 4.1.135.Final Advisory →
- Fix · GHSA-c2gf-v879-257j io.netty:netty-codec-http2 (Maven) Fixed in 4.2.15.Final Advisory →
Red Hat 25 advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:76128 Released 2026-10-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el7sso
- RHSA-2026:76130 Released 2026-10-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el9sso
Show 22 more Red Hat advisories
- RHSA-2026:76129 Released 2026-10-06 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el8sso
- RHSA-2026:76134 Released 2026-10-05 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 for OpenShift image security update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2026:76132 Released 2026-10-05 · Red Hat rating ImportantRed Hat Single Sign-On 7.6.13 security update
- Red Hat Single Sign-On 7.6.13
- RHSA-2026:66488 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.14.1 release and security update
- Red Hat AMQ Broker 7.14.1
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:54435 Released 2026-08-12 · Red Hat rating ImportantStreams for Apache Kafka 3.2.1 release and security update
- Streams for Apache Kafka 3.2.1
- RHSA-2026:53806 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 security update
- Red Hat JBoss Enterprise Application Platform 7.4.25
- RHSA-2026:53646 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 Security update
- Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el9eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el9eap +47
- RHSA-2026:53645 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 Security update
- Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el8eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el8eap +47
- RHSA-2026:53644 Released 2026-08-11 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 7.4.25 security pdate
- Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-activemq-artemis-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-cli-2.16.0-22.redhat_00057.1.el7eap, eap7-activemq-artemis-commons-2.16.0-22.redhat_00057.1.el7eap +47
- RHSA-2026:50085 Released 2026-08-04 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release
- Red Hat JBoss Enterprise Application Platform 6.0.5.GA io.netty.netty-codec-http2-4.1.135.Final-redhat-00001.jar
- RHSA-2026:48151 Released 2026-07-29 · Red Hat rating ImportantRed Hat build of Cryostat security update
- Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
- RHSA-2026:48124 Released 2026-07-29 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.1 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +2
- RHSA-2026:41951 Released 2026-07-20 · Red Hat rating ImportantRed Hat Data Grid 8.6.2 security update
- Red Hat Data Grid 8.6.2
- RHSA-2026:37390 Released 2026-07-09 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18.1.P1 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
- RHSA-2026:36820 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.0 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
- RHSA-2026:34608 Released 2026-07-02 · Red Hat rating ImportantStreams for Apache Kafka 2.9.4 release and security update
- Streams for Apache Kafka 2.9.4
- RHSA-2026:30083 Released 2026-06-25 · Red Hat rating ImportantRed Hat build of Keycloak 26.6.4 Security Update
- Red Hat build of Keycloak 26.6.4
- RHSA-2026:30049 Released 2026-06-25 · Red Hat rating ImportantRed Hat build of Keycloak 26.4.13 Security Update
- Red Hat build of Keycloak 26.4.13
- RHSA-2026:26586 Released 2026-06-17 · Red Hat rating ImportantRed Hat build of Apache Camel 4.18 for Quarkus 3.33 security update
- Red Hat Build of Apache Camel 3.33.2.SP1 io.netty.netty-codec-haproxy-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.135.Final-redhat-00001.jar, io.netty.netty-handler-4.1.135.Final-redhat-00001.jar +3
- RHSA-2026:26018 Released 2026-06-17 · Red Hat rating ImportantRed Hat build of Quarkus 3.27.4.SP1 security update
- Red Hat build of Quarkus 3.27.4.SP1 io.netty.netty-codec-haproxy-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.135.Final-redhat-00001.jar +4
- RHSA-2026:26017 Released 2026-06-17 · Red Hat rating ImportantRed Hat build of Quarkus 3.33.2.SP1 security update
- Red Hat build of Quarkus 3.33.2.SP1 io.netty.netty-codec-haproxy-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.135.Final-redhat-00001.jar +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix planned: Will not fix |
| Cryostat 4 on RHEL 9 | Fixed | RHSA-2026:48151 |
| Middleware Containers for OpenShift | Fixed | RHSA-2026:76134 |
| Red Hat AMQ Broker 7.14.1 | Fixed | RHSA-2026:66488 |
| Red Hat Build of Apache Camel 3.33.2.SP1 | Fixed | RHSA-2026:26586 |
| Red Hat Data Grid 8.6.2 | Fixed | RHSA-2026:41951 |
| Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server | Fixed | RHSA-2026:53644 |
| Red Hat JBoss Enterprise Application Platform 6.0.5.GA | Fixed | RHSA-2026:50085 |
| Red Hat JBoss Enterprise Application Platform 7.4.25 | Fixed | RHSA-2026:53806 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:36820, RHSA-2026:48124 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2026:76128 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2026:76129 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2026:76130 |
| Red Hat Single Sign-On 7.6.13 | Fixed | RHSA-2026:76132 |
| Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 | Fixed | RHSA-2026:37390 |
| Red Hat build of Keycloak 26.4.13 | Fixed | RHSA-2026:30049 |
| Red Hat build of Keycloak 26.6.4 | Fixed | RHSA-2026:30083 |
| Red Hat build of Quarkus 3.27.4.SP1 | Fixed | RHSA-2026:26018 |
| Red Hat build of Quarkus 3.33.2.SP1 | Fixed | RHSA-2026:26017 |
| Streams for Apache Kafka 2.9.4 | Fixed | RHSA-2026:34608 |
| Streams for Apache Kafka 3.2.1 | Fixed | RHSA-2026:54435 |
Not affected: 9 products
- Cryostat 4 on RHEL 9
- Red Hat Build of Apache Camel 3.33.2.SP1
- Red Hat JBoss Enterprise Application Platform 6.0.5.GA
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat build of Quarkus 3.27.4.SP1
- Red Hat build of Quarkus 3.33.2.SP1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48043
- 2026-10-03 Alias added: GHSA-c2gf-v879-257j
- 2026-10-06 Fix available: RHSA-2026:76134 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76132 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76129 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76130 · Red Hat
- 2026-10-06 Fix available: Middleware Containers for OpenShift, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9 +1 · Red Hat
- 2026-10-06 2 new references · GHSA-c2gf-v879-257j
- 2026-10-07 Fix available: RHSA-2026:76128 · Red Hat
- 2026-10-07 Fix available: Red Hat Single Sign-On 7.6 for RHEL 7 Server · Red Hat
- 2026-10-09 Fix available: Red Hat JBoss Enterprise Application Platform 8.1 · Red Hat
- 2026-10-13 Fix available: Red Hat Build of Apache Camel 3.33.2.SP1 · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat JBoss Enterprise Application Platform 6.0.5.GA, Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-21 Affected versions changed · Red Hat
- 2026-10-23 Fix available: RHSA-2026:30049 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:30083 · Red Hat
- 2026-10-23 Fix available: Red Hat build of Keycloak 26.4.13, Red Hat build of Keycloak 26.6.4 · Red Hat
- 2026-11-01 Affected versions changed · Red Hat
References
Advisory 2
Other 25
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e
- https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json
- https://github.com/netty/netty
- https://bugzilla.redhat.com/show_bug.cgi?id=2488442
- https://access.redhat.com/security/cve/CVE-2026-48043
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:48124
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26017
More Netty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
- TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
- TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
- TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
- TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
Sources
- CVE-2026-48043 · CVE Program
- CVE-2026-48043 · NVD
- FIRST EPSS
- GHSA-c2gf-v879-257j · GitHub Advisory Database · CC BY 4.0
- CVE-2026-48043 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences