CVE-2026-48043

Maven/io.netty:netty-codec-http2 CVE-2026-48043: medium 5.3

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Action: Upgrade io.netty:netty-codec-http2 to 4.1.135.Final (4.1.x) or 4.2.15.Final (4.2.x) or later.

Affected

Fixed versions

Sources

• osv: GHSA-c2gf-v879-257j
• https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j
• https://nvd.nist.gov/vuln/detail/CVE-2026-48043
• https://github.com/netty/netty/commit/db6138b168699736a6463c367e12ad0a4c36a25e
• https://github.com/netty/netty/commit/3d45a1e4e8eb99144f716e54be5ac57e525fa7ca
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
• https://github.com/netty/netty
• https://bugzilla.redhat.com/show_bug.cgi?id=2488442
• https://access.redhat.com/security/cve/CVE-2026-48043
• https://access.redhat.com/errata/RHSA-2026:66488
• https://access.redhat.com/errata/RHSA-2026:65126
• https://access.redhat.com/errata/RHSA-2026:54435
• https://access.redhat.com/errata/RHSA-2026:53806
• https://access.redhat.com/errata/RHSA-2026:53646
• https://access.redhat.com/errata/RHSA-2026:53645
• https://access.redhat.com/errata/RHSA-2026:53644
• https://access.redhat.com/errata/RHSA-2026:50085
• https://access.redhat.com/errata/RHSA-2026:48151
• https://access.redhat.com/errata/RHSA-2026:48124
• https://access.redhat.com/errata/RHSA-2026:41951
• https://access.redhat.com/errata/RHSA-2026:37390
• https://access.redhat.com/errata/RHSA-2026:36820
• https://access.redhat.com/errata/RHSA-2026:34608
• https://access.redhat.com/errata/RHSA-2026:26586
• https://access.redhat.com/errata/RHSA-2026:26018
• https://access.redhat.com/errata/RHSA-2026:26017

CVE-2026-48043 · published 2026-06-11T13:28:46Z · modified 2026-10-06T19:45:03.555042181Z · JSON