CVE-2026-48748
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A memory exhaustion vulnerability in Netty before version 4.2.15.Final allows creating an infinite number of blocked streams in the HTTP/3 codec, leading to an OOM error.
Risk Assessment
An attacker can remotely cause a server crash due to memory exhaustion, resulting in service disruption and potential data loss.
Recommendation
Immediately update Netty to version 4.2.15.Final or later, which includes the fix for this vulnerability.
Original NVD description (English source)
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.