CVE-2026-48748: Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-12 · updated 2026-08-04
Weakness: CWE-770

Description

Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

Affected products

netty: from 4.2.0 before 4.2.15 — fixed in 4.2.15

How to fix

Upgrade to a fixed version: netty 4.2.15. Check the vendor advisory for mitigations.

References

https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d
https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
https://github.com/netty/netty/security/advisories/GHSA-4grm-h2qv-h6w6
https://access.redhat.com/security/cve/CVE-2026-48748
https://bugzilla.redhat.com/show_bug.cgi?id=2488441
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48748.json

Get alerted when CVE-2026-48748 or the next vulnerability affects your stack