VYPR
← All advisories
Medium severity5.3GHSA Advisory· Published Jun 12, 2026· Updated Jun 15, 2026

CVE-2026-48043

CVE-2026-48043

Description

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled ByteBuf handed to an anonymous ChannelInboundHandlerAdapter tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
io.netty:netty-codec-http2Maven
< 4.1.135.Final4.1.135.Final
io.netty:netty-codec-http2Maven
>= 4.2.0.Alpha1, < 4.2.15.Final4.2.15.Final

Affected products

152

Patches

Vulnerability mechanics

References

5

News mentions

1