En bref
- CVE-2026-48043 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant io.netty:netty-codec-http2, netty (netty).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.75%, plus élevée que 55.1% des vulnérabilités.
- Correctif : mettre à jour vers 4.2.15.Final, 4.1.135.Final, 4.2.15, 4.1.135 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| io.netty:netty-codec-http2 Maven | ≥ 4.2.0.Alpha1, < 4.2.15.Final< 4.1.135.Final
| 4.2.15.Final4.1.135.Final
|
| netty | ≥ 4.2.0, < 4.2.15< 4.1.135
| 4.2.154.1.135
|
Description
Impact
The DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled ByteBuf handed to an anonymous ChannelInboundHandlerAdapter tail handler, which becomes the sole owner responsible for releasing it.
A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME.
NVD description
Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Autres vulnérabilités de io.netty:netty-codec-http2
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free