CVE-2026-48748

Published: Jun 12, 2026Modified: Aug 4, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

Affected (1)

Products: Netty: Netty

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Netty Netty	From 4.2.0 to 4.2.15

Related CWEs

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (6)

https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d

Source: security-advisories@github.com

https://github.com/netty/netty/releases/tag/netty-4.2.15.Final

Source: security-advisories@github.com

Release Notes

https://github.com/netty/netty/security/advisories/GHSA-4grm-h2qv-h6w6

Source: security-advisories@github.com

Vendor Advisory

https://access.redhat.com/security/cve/CVE-2026-48748

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2488441

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48748.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.