CVE-2026-48043GHSA-c2gf-v879-257j
io.netty:netty-codec-http2: netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
netty io.netty:netty-codec-http2mavenFrameworks
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.88%Chance of exploitation activity in the next 30 days, higher than 58% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.1.135.Finalio.netty:netty-codec-http2, mavenGitHub
<dependency><groupId>io.netty</groupId><artifactId>netty-codec-http2</artifactId><version>4.1.135.Final</version></dependency> - 4.2.15.Finalio.netty:netty-codec-http2, mavenGitHub
<dependency><groupId>io.netty</groupId><artifactId>netty-codec-http2</artifactId><version>4.2.15.Final</version></dependency> - 4.1.135.Finalio.netty:netty-codec-http2, MavenOSV
<dependency><groupId>io.netty</groupId><artifactId>netty-codec-http2</artifactId><version>4.1.135.Final</version></dependency> - 4.2.15.Finalio.netty:netty-codec-http2, MavenOSV
<dependency><groupId>io.netty</groupId><artifactId>netty-codec-http2</artifactId><version>4.2.15.Final</version></dependency>
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Impact
The DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled ByteBuf handed to an anonymous ChannelInboundHandlerAdapter tail handler, which becomes the sole owner responsible for releasing it.
A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME.
Text from GitHub Advisory Database
Affected versions 81
- io.netty:netty-codec-http2, maven<= 4.1.134.FinalGitHub
- io.netty:netty-codec-http2, maven>= 4.2.0.Alpha1, <= 4.2.14.FinalGitHub
- nettyaffected: >= 4.2.0.Final, < 4.2.15.FinalCVE List
- nettyaffected: < 4.1.135.FinalCVE List
- io.netty:netty-codec-http2, Mavenfrom first release, fixed in 4.1.135.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.0.Beta4OSV
- io.netty:netty-codec-http2, Maven4.1.0.Beta5OSV
- io.netty:netty-codec-http2, Maven4.1.0.Beta6OSV
- io.netty:netty-codec-http2, Maven4.1.0.Beta7OSV
- io.netty:netty-codec-http2, Maven4.1.0.Beta8OSV
- io.netty:netty-codec-http2, Maven4.1.0.CR1OSV
- io.netty:netty-codec-http2, Maven4.1.0.CR2OSV
- io.netty:netty-codec-http2, Maven4.1.0.CR3OSV
- io.netty:netty-codec-http2, Maven4.1.0.CR4OSV
- io.netty:netty-codec-http2, Maven4.1.0.CR5OSV
- io.netty:netty-codec-http2, Maven4.1.0.CR6OSV
- io.netty:netty-codec-http2, Maven4.1.0.CR7OSV
- io.netty:netty-codec-http2, Maven4.1.0.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.1.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.10.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.100.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.101.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.102.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.103.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.104.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.105.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.106.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.107.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.108.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.109.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.11.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.110.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.111.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.112.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.113.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.114.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.115.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.116.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.117.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.118.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.119.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.12.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.120.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.121.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.122.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.123.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.124.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.125.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.126.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.127.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.128.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.129.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.13.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.130.FinalOSV
- io.netty:netty-codec-http2, Maven4.1.131.FinalOSV
- io.netty:netty-codec-http2, Mavenfrom 4.2.0.Alpha1, fixed in 4.2.15.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.0.Alpha1OSV
- io.netty:netty-codec-http2, Maven4.2.0.Alpha2OSV
- io.netty:netty-codec-http2, Maven4.2.0.Alpha3OSV
- io.netty:netty-codec-http2, Maven4.2.0.Alpha4OSV
- io.netty:netty-codec-http2, Maven4.2.0.Alpha5OSV
- io.netty:netty-codec-http2, Maven4.2.0.Beta1OSV
- io.netty:netty-codec-http2, Maven4.2.0.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.0.RC1OSV
- io.netty:netty-codec-http2, Maven4.2.0.RC2OSV
- io.netty:netty-codec-http2, Maven4.2.0.RC3OSV
- io.netty:netty-codec-http2, Maven4.2.0.RC4OSV
- io.netty:netty-codec-http2, Maven4.2.1.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.10.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.11.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.12.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.13.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.14.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.2.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.3.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.4.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.5.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.6.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.7.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.8.FinalOSV
- io.netty:netty-codec-http2, Maven4.2.9.FinalOSV
References 27
- github.com/netty/netty/releases/tag/netty-4.1.135.FinalFixvia CVE List
- github.com/netty/netty/releases/tag/netty-4.2.15.FinalFixvia CVE List
- github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25eFixvia GitHub
- github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7caFixvia GitHub
- github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257jAdvisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:26017Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:26018Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:26586Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:34608Advisoryvia CVE List
- access.redhat.com/security/cve/CVE-2026-48043Advisoryvia CVE List
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.jsonAdvisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:36820Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:37390Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:41951Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:48124Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:48151Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:50085Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:53806Advisoryvia GitHub
- access.redhat.com/errata/RHSA-2026:53644Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:54435Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:65126Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:66488Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:53646Advisoryvia CVE List
- access.redhat.com/errata/RHSA-2026:53645Advisoryvia CVE List
- github.com/advisories/GHSA-c2gf-v879-257jAdvisoryvia GitHub
- nvd.nist.gov/vuln/detail/CVE-2026-48043Referencevia GitHub
- bugzilla.redhat.com/show_bug.cgi?id=2488442Referencevia CVE List