GHSA-c2gf-v879-257j: netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

mediumCVSS 5.3CVE-2026-48043

Impact The DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled ByteBuf handed to an anonymous ChannelInboundHandlerAdapter tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-controller throwing and so trigger a resource leak which at the end might take down the whole JVM due OOME.

Details

Source: GitHub Security Advisories (INTL · database · site)
Severity: medium — CVSS 5.3
Published: 2026-06-11
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://github.com/advisories/GHSA-c2gf-v879-257j

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-480430.59% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-48043	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[UPDATE] [high] Netty: Multiple vulnerabilitiescert-bund

GHSA-c2gf-v879-257j: netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Details

Exploitation outlook

Referenced CVEs

Same CVEs, other sources

More from GitHub Security Advisories