CVE-2026-48748: Netty HTTP/3 Codec DOS Vulnerability

CVE-2026-48748 Overview

CVE-2026-48748 is a memory exhaustion vulnerability in the Netty HTTP/3 codec. Netty is a network application framework used to build protocol servers and clients in Java. The flaw allows a remote attacker to create an unbounded number of blocked streams, eventually triggering an out-of-memory (OOM) condition on the server. The issue affects all Netty releases prior to 4.2.15.Final and is tracked under CWE-770: Allocation of Resources Without Limits or Throttling. Netty version 4.2.15.Final resolves the vulnerability. The maintainers published details in GitHub Security Advisory GHSA-4grm-h2qv-h6w6.

Critical Impact
Unauthenticated remote attackers can exhaust server memory through the HTTP/3 codec, causing denial of service on applications that embed vulnerable Netty versions.

Affected Products

Netty versions prior to 4.2.15.Final
Applications and frameworks embedding the Netty HTTP/3 codec
Java network services built on the netty:netty component

Discovery Timeline

2026-06-12 - CVE-2026-48748 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48748

Vulnerability Analysis

The vulnerability resides in the Netty HTTP/3 codec, which handles stream multiplexing over QUIC. The codec does not enforce an upper bound on the number of blocked streams it tracks per connection. An attacker can open streams that remain in a blocked state, forcing Netty to retain associated state objects in memory indefinitely. As the attacker creates additional blocked streams, heap usage grows until the Java Virtual Machine throws an OutOfMemoryError. The result is a denial-of-service condition affecting availability without compromising confidentiality or integrity. The defect is classified under CWE-770, which covers missing resource throttling.

Root Cause

The root cause is the absence of a maximum threshold for blocked HTTP/3 streams within the codec's bookkeeping structures. Netty queues blocked stream context objects without applying per-connection limits or eviction policies. Without throttling, a single misbehaving or malicious client can drive memory allocation beyond reasonable application limits.

Attack Vector

Exploitation requires only network access to a service exposing the Netty HTTP/3 endpoint. No authentication, user interaction, or privileged access is needed. An attacker establishes a QUIC connection and repeatedly initiates streams that the codec classifies as blocked. The attacker sustains these streams to inflate codec state until the target process exhausts heap memory and terminates or stops servicing legitimate clients.

No public proof-of-concept code is currently available. The technical details are documented in the Netty 4.2.15.Final release notes and the project's security advisory.

Detection Methods for CVE-2026-48748

Indicators of Compromise

Java applications terminating with java.lang.OutOfMemoryError originating from HTTP/3 codec classes in io.netty.handler.codec.http3
Sustained heap growth correlated with inbound QUIC connections opening many streams that never progress past the blocked state
Unusual volume of HTTP/3 stream-open frames from a small number of source IP addresses

Detection Strategies

Inspect application logs for repeated garbage collection pauses and OOM events tied to Netty HTTP/3 components
Use software composition analysis (SCA) tooling to enumerate the netty:netty versions deployed across services
Monitor QUIC and HTTP/3 telemetry for clients that open streams at a high rate without completing requests

Monitoring Recommendations

Alert on JVM heap usage exceeding configured thresholds on services exposing HTTP/3 endpoints
Track per-connection stream counts and flag connections with abnormally high numbers of unresolved streams
Forward JVM, application, and network telemetry to a centralized analytics platform for correlation across hosts

How to Mitigate CVE-2026-48748

Immediate Actions Required

Upgrade Netty to version 4.2.15.Final or later across all affected services and rebuild downstream artifacts
Inventory transitive dependencies to identify frameworks that bundle vulnerable Netty releases
Restrict HTTP/3 exposure at the network edge until patching is complete

Patch Information

Netty 4.2.15.Final contains the fix and is available from the project's release page. See the Netty 4.2.15.Final release notes and GitHub Security Advisory GHSA-4grm-h2qv-h6w6 for advisory details and upgrade guidance.

Workarounds

Disable the HTTP/3 codec on services where it is not strictly required
Place a rate-limiting reverse proxy or QUIC-aware load balancer in front of vulnerable services to cap concurrent streams per client
Configure JVM heap sizing and out-of-memory handlers to fail fast and restart cleanly when memory pressure is detected

bash

# Maven dependency update to the patched version
# pom.xml
# <dependency>
#   <groupId>io.netty</groupId>
#   <artifactId>netty-all</artifactId>
#   <version>4.2.15.Final</version>
# </dependency>

mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.2.15.Final
mvn dependency:tree | grep io.netty