7.5
High
CVE-2026-48748 Netty is a network application framework for development of protocol servers and clients
Description
Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| netty 4.2 | 4.2.0.Final → < 4.2.15.Final | 4.2.15.Final |
| Red Hat build of Apache Camel - HawtIO 4 | Versions not published |
References
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of netty
The 95 CVEs of netty →
CVE-2026-100666
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to…
6.9
Medium
CVE-2026-100665
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC…
8.7
High
CVE-2026-100664
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority…
8.7
High
CVE-2026-100663
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1…
8.7
High