CVE-2026-48043 Overview
CVE-2026-48043 is a resource exhaustion vulnerability in Netty, a widely used Java network application framework. The flaw resides in the netty-codec-http2 module, specifically in the DelegatingDecompressorFrameListener class that handles HTTP/2 decompression. A remote attacker can send crafted HTTP/2 frames that cause the flow controller to throw an exception, leaking pooled ByteBuf instances. Sustained exploitation exhausts heap memory and triggers an OutOfMemoryError (OOME), taking down the Java Virtual Machine (JVM). The issue affects versions prior to 4.1.135.Final and 4.2.15.Final, both of which contain the patch. The weakness is classified as [CWE-400] Uncontrolled Resource Consumption.
Critical Impact
Remote unauthenticated attackers can crash Netty-based HTTP/2 servers by triggering a pooled buffer leak that exhausts JVM memory.
Affected Products
- Netty netty-codec-http2 versions prior to 4.1.135.Final
- Netty netty-codec-http2 versions prior to 4.2.15.Final
- Applications and servers embedding vulnerable Netty releases for HTTP/2 traffic handling
Discovery Timeline
- 2026-06-12 - CVE-2026-48043 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2026-48043
Vulnerability Analysis
The DelegatingDecompressorFrameListener class orchestrates HTTP/2 payload decompression for gzip, deflate, and zstd content encodings. For each HTTP/2 stream, it instantiates a per-stream EmbeddedChannel that runs the appropriate decompression codec. Decompressed chunks emerge as pooled ByteBuf instances and are forwarded to a wrapped listener through an anonymous ChannelInboundHandlerAdapter tail handler. That tail handler becomes the sole owner responsible for releasing each pooled buffer.
The vulnerability manifests when a remote peer sends frames that cause the HTTP/2 flow controller to throw an exception during chunk delivery. The exception interrupts the normal forwarding path before the tail handler can release ownership of the pooled buffer. The leaked ByteBuf instances accumulate on the heap with no remaining reference path to release them.
Repeated exploitation across many streams compounds the leak rapidly because pooled allocators retain direct memory regions. The JVM ultimately raises an OutOfMemoryError, terminating the affected process and producing a denial-of-service condition against any service relying on Netty for HTTP/2 traffic.
Root Cause
The root cause is improper buffer ownership handling on the exception path. The decompression pipeline transfers buffer ownership to the tail handler, but exceptions thrown by the flow controller bypass the handler invocation. No finally or release-on-exception logic existed to reclaim the pooled ByteBuf, satisfying the conditions for [CWE-400] Uncontrolled Resource Consumption.
Attack Vector
Exploitation requires only network access to an HTTP/2 endpoint running a vulnerable Netty version. The attacker establishes an HTTP/2 connection and transmits compressed frames crafted to provoke the flow controller exception. No authentication or user interaction is required. Refer to the GitHub Security Advisory GHSA-c2gf-v879-257j for the maintainer's technical write-up.
Detection Methods for CVE-2026-48043
Indicators of Compromise
- JVM termination events accompanied by java.lang.OutOfMemoryError: Direct buffer memory or heap exhaustion messages in application logs
- Netty leak detector warnings referencing DelegatingDecompressorFrameListener or unreleased ByteBuf instances
- Sudden growth in direct memory or pooled allocator metrics on HTTP/2-facing services
Detection Strategies
- Inventory Java applications and identify those packaging netty-codec-http2 below 4.1.135.Final or 4.2.15.Final using software composition analysis (SCA) tooling
- Enable Netty's ResourceLeakDetector at PARANOID level in non-production environments to surface buffer leaks during fuzz testing
- Correlate HTTP/2 GOAWAY frames and stream resets with abnormal memory growth to identify probing attempts
Monitoring Recommendations
- Track JVM heap and direct memory utilization with alerting thresholds that fire before OOME conditions occur
- Monitor HTTP/2 connection rates, compressed payload volumes, and per-stream error counts for anomalies
- Forward application and garbage collection logs to a centralized analytics platform to detect repeated process restarts
How to Mitigate CVE-2026-48043
Immediate Actions Required
- Upgrade netty-codec-http2 to 4.1.135.Final or 4.2.15.Final immediately across all affected services
- Audit transitive dependencies in Maven and Gradle builds to surface bundled vulnerable Netty versions
- Restart Java services after upgrading to flush any pre-existing leaked buffer state
Patch Information
The Netty maintainers released fixed versions on GitHub: Netty 4.1.135.Final and Netty 4.2.15.Final. Both releases ensure pooled ByteBuf instances are released when the flow controller raises an exception during HTTP/2 decompression.
Workarounds
- Disable HTTP/2 content decompression by removing the DelegatingDecompressorFrameListener from the pipeline where the feature is not required
- Place a reverse proxy that terminates HTTP/2 and rejects malformed compressed payloads in front of vulnerable Netty services
- Apply rate limiting and connection caps on HTTP/2 endpoints to slow exploitation until patches can be deployed
# Maven dependency override example
mvn versions:use-dep-version \
-Dincludes=io.netty:netty-codec-http2 \
-DdepVersion=4.1.135.Final \
-DforceVersion=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
