CVE-2026-45536

Name of the Vulnerable Software and Affected Versions Netty (affected versions not specified)

Description A file descriptor leak occurs in the netty unix socket recvFd function when a peer sends two file descriptors simultaneously via an SCM RIGHTS control message. The system allocates a control buffer of 24 bytes on 64-bit Linux, which exactly fits a control message containing two integers. Because the kernel installs both descriptors without triggering a MSG CTRUNC flag, a subsequent length check cmsg->cmsg len == CMSG LEN(sizeof(int)) fails as it expects 20 bytes. This causes the application to skip the logic that reads the descriptor and fails to close the installed descriptors. The process then exits the read loop normally, resulting in two leaked file descriptors per message. This issue is reachable via Epoll/KQueue DomainSocketChannel when the application is configured with DomainSocketReadMode.FILE DESCRIPTORS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.