CVE-2026-48043 PUBLISHED

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Assigner: GitHub_M
Reserved: 20.05.2026 Published: 12.06.2026 Updated: 12.06.2026

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled ByteBuf handed to an anonymous ChannelInboundHandlerAdapter tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 5.3

Product Status

Vendor netty
Product netty
Versions
  • Version >= 4.2.0.Final, < 4.2.15.Final is affected
  • Version < 4.1.135.Final is affected

References

Problem Types

  • CWE-400: Uncontrolled Resource Consumption CWE
  • CWE-401: Missing Release of Memory after Effective Lifetime CWE