Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M
CVE-2026-48748Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
High 7.5
In plain English
A high-severity resource allocation without limits in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | netty | no fix listed | DEBIAN-CVE-2026-48748 |
| Debian:13 | netty | no fix listed | DEBIAN-CVE-2026-48748 |
| Debian:14 | netty | no fix listed | DEBIAN-CVE-2026-48748 |
| Maven | io.netty:netty-codec-http3 | 4.2.15.Final | GHSA-4grm-h2qv-h6w6 |
| Ubuntu:25.10 | netty | no fix listed | UBUNTU-CVE-2026-48748 |
| Ubuntu:26.10 | netty | no fix listed | UBUNTU-CVE-2026-48748 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/netty/netty/security/advisories/GHSA-4grm-h2qv-h6w6 x_refsource_CONFIRM
- https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-48748 vdb-entry, x_refsource_REDHAT
- RHBZ#2488441 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48748.json x_sadp-csaf-vex