CVE-2026-48748

Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48748.json",
    "cwe_ids": [
        "CWE-770"
    ]
}

References

Affected packages

Git / github.com/netty/netty

Affected ranges

Type

GIT

Repo

https://github.com/netty/netty

Events

Introduced

09e64d259c99be8b5b2a471a78f11e65eb82598a

Fixed

a41f7b289ce1d697c50846f3ade3983e22b2ed40

Fixed

75127cab731ee35068d1f0667bffa188bc332f5d

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.2.0"
        },
        {
            "fixed": "4.2.15"
        }
    ],
    "cpe": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

netty-4.*

netty-4.2.0.Final

netty-4.2.1.Final

netty-4.2.10.Final

netty-4.2.11.Final

netty-4.2.12.Final

netty-4.2.13.Final

netty-4.2.14.Final

netty-4.2.2.Final

netty-4.2.3.Final

netty-4.2.4.Final

netty-4.2.5.Final

netty-4.2.6.Final

netty-4.2.7.Final

netty-4.2.8.Final

netty-4.2.9.Final

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 713.0,
            "function_hash": "208243128831275936285332049905586545947"
        },
        "id": "CVE-2026-48748-7be10415",
        "signature_type": "Function",
        "source": "https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d",
        "target": {
            "function": "sendInsertCountIncrementIfRequired",
            "file": "codec-http3/src/main/java/io/netty/handler/codec/http3/QpackDecoder.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "21754645001515030834113299212124731769",
                "172838992448531872845271890632009605907",
                "44958106496574747514271880965201931720",
                "59207280830582520865078850121578708959",
                "64756998553775844191539824958504057262",
                "252149360748863141622086955854278661917",
                "185881296433637718072040075680320427881",
                "6893151592238694596920641480164636",
                "318049884246300480655186894369132408820"
            ]
        },
        "id": "CVE-2026-48748-84add8ce",
        "signature_type": "Line",
        "source": "https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d",
        "target": {
            "file": "codec-http3/src/main/java/io/netty/handler/codec/http3/QpackDecoder.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "56110798983854709435309282772440955813",
                "31711312293948880834057766419755480480",
                "23453695075021313846951862281753889095",
                "60795394085200845985618915010101850892",
                "188581947770825935615795215974184340894",
                "40147450776277439667920763083022983686",
                "143494383224603299917169766192569271881",
                "31663844093658487174875861983252333642",
                "248406137649509361778428931122000860497",
                "164759364825196012257909499082972309261",
                "219471178909495080159311201694617567424",
                "141203384987428086280381732755106282220",
                "188425366344977074217790441553437038532",
                "115364678329281381304101259216399959999",
                "13217650229334389285657190791063211508",
                "247817581983006181081817449769414735431",
                "281265484471589678233631879988847936492",
                "78994249371522946654327968794675619107"
            ]
        },
        "id": "CVE-2026-48748-866a83b6",
        "signature_type": "Line",
        "source": "https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d",
        "target": {
            "file": "codec-http3/src/test/java/io/netty/handler/codec/http3/QpackDecoderTest.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 527.0,
            "function_hash": "237724202689811390153691886048115616034"
        },
        "id": "CVE-2026-48748-9b5c18df",
        "signature_type": "Function",
        "source": "https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d",
        "target": {
            "function": "setup",
            "file": "codec-http3/src/test/java/io/netty/handler/codec/http3/QpackDecoderTest.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 225.0,
            "function_hash": "113519481253626595275413264530018167269"
        },
        "id": "CVE-2026-48748-ee95f23d",
        "signature_type": "Function",
        "source": "https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d",
        "target": {
            "function": "shouldWaitForDynamicTableUpdates",
            "file": "codec-http3/src/main/java/io/netty/handler/codec/http3/QpackDecoder.java"
        }
    }
]

vanir_signatures_modified

"2026-08-07T17:02:00Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48748.json"