--- cve: "CVE-2026-48043" severity: "MEDIUM" cvss: 5.3 epss: "62%" vendor: "netty" kev: false exploited: false published: "2026-06-12 16:16:30" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-10T10:57:41+02:00" --- # CVE-2026-48043 > 5.3 MEDIUM · 🧪 PoC ## Beschreibung Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Keine | good | | I Integrität | Keine | good | | A Verfügbarkeit | Gering | warn | ## Patch verfügbar (OSV) - f05f765d81460799c53123a207f665bf3b465171 (Commit) - a41f7b289ce1d697c50846f3ade3983e22b2ed40 (Commit) ## Referenzen - - - - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-48043) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_