{"schema":"threatline.record/2","record":{"id":"CVE-2026-48043","aliases":["GHSA-c2gf-v879-257j"],"summary":"netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion","details":"### Impact\n\nThe `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it.\n\nA remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME.","categories":["Frameworks"],"product":"io.netty:netty-codec-http2","vendor":"netty","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c2gf-v879-257j","source_modified_at":"2026-10-06T19:33:24Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"io.netty:netty-codec-http2"},"range":"<= 4.1.134.Final"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c2gf-v879-257j","source_modified_at":"2026-10-06T19:33:24Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"io.netty:netty-codec-http2"},"range":">= 4.2.0.Alpha1, <= 4.2.14.Final"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-48043","source_modified_at":"2026-09-18T12:04:47.039Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"netty","vendor":"netty","versions":[{"version":">= 4.2.0.Final, < 4.2.15.Final","status":"affected"},{"version":"< 4.1.135.Final","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c2gf-v879-257j","source_modified_at":"2026-10-06T19:45:03.555042181Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"io.netty:netty-codec-http2","ecosystem":"Maven","purl":"pkg:maven/io.netty/netty-codec-http2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.135.Final"}]}],"versions":["4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.101.Final","4.1.102.Final","4.1.103.Final","4.1.104.Final","4.1.105.Final","4.1.106.Final","4.1.107.Final","4.1.108.Final","4.1.109.Final","4.1.11.Final","4.1.110.Final","4.1.111.Final","4.1.112.Final","4.1.113.Final","4.1.114.Final","4.1.115.Final","4.1.116.Final","4.1.117.Final","4.1.118.Final","4.1.119.Final","4.1.12.Final","4.1.120.Final","4.1.121.Final","4.1.122.Final","4.1.123.Final","4.1.124.Final","4.1.125.Final","4.1.126.Final","4.1.127.Final","4.1.128.Final","4.1.129.Final","4.1.13.Final","4.1.130.Final","4.1.131.Final"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c2gf-v879-257j","source_modified_at":"2026-10-06T19:45:03.555042181Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"io.netty:netty-codec-http2","ecosystem":"Maven","purl":"pkg:maven/io.netty/netty-codec-http2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Alpha1"},{"fixed":"4.2.15.Final"}]}],"versions":["4.2.0.Alpha1","4.2.0.Alpha2","4.2.0.Alpha3","4.2.0.Alpha4","4.2.0.Alpha5","4.2.0.Beta1","4.2.0.Final","4.2.0.RC1","4.2.0.RC2","4.2.0.RC3","4.2.0.RC4","4.2.1.Final","4.2.10.Final","4.2.11.Final","4.2.12.Final","4.2.13.Final","4.2.14.Final","4.2.2.Final","4.2.3.Final","4.2.4.Final","4.2.5.Final","4.2.6.Final","4.2.7.Final","4.2.8.Final","4.2.9.Final"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c2gf-v879-257j","source_modified_at":"2026-10-06T19:33:24Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"io.netty:netty-codec-http2"},"version":"4.1.135.Final"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-c2gf-v879-257j","source_modified_at":"2026-10-06T19:33:24Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"io.netty:netty-codec-http2"},"version":"4.2.15.Final"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c2gf-v879-257j","source_modified_at":"2026-10-06T19:45:03.555042181Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"io.netty:netty-codec-http2","ecosystem":"Maven","purl":"pkg:maven/io.netty/netty-codec-http2"},"version":"4.1.135.Final"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-c2gf-v879-257j","source_modified_at":"2026-10-06T19:45:03.555042181Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"io.netty:netty-codec-http2","ecosystem":"Maven","purl":"pkg:maven/io.netty/netty-codec-http2"},"version":"4.2.15.Final"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00882,"percentile":0.58775,"score_date":"2026-10-23"},"published_at":"2026-06-12T14:39:52.498Z","modified_at":"2026-10-06T19:45:03.555042181Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-c2gf-v879-257j","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T19:33:24Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-48043","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-18T12:04:47.039Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-c2gf-v879-257j","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T19:45:03.555042181Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-48043","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48043","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:26017","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:26018","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:26586","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/security/cve/CVE-2026-48043","tags":["vdb-entry","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488442","tags":["issue-tracking","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json","tags":["x_sadp-csaf-vex"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:36820","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:48124","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:48151","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:50085","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53806","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:53644","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:65126","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:53646","tags":["vendor-advisory","x_refsource_REDHAT"]},{"source":"CVE List","url":"https://access.redhat.com/errata/RHSA-2026:53645","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e","source":"GitHub Advisory Database"},{"url":"https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-c2gf-v879-257j","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-06-12T15:59:47.481904Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-06T19:45:03.555042181Z","content_hash":"de1a4be98810b22e30b5835a82017d6ce76844eedcadc1e6c28051bfb1844009"}}