CVE-2026-48043

Name of the Vulnerable Software and Affected Versions netty-codec-http2 versions prior to 4.1.135.Final netty-codec-http2 versions prior to 4.2.15.Final

Description The DelegatingDecompressorFrameListener class manages HTTP/2 decompression by using a per-stream EmbeddedChannel to run decompression codecs such as gzip, deflate, or zstd. Decompressed chunks are handled as pooled ByteBuf objects and passed to an anonymous ChannelInboundHandlerAdapter tail handler responsible for their release. A remote peer can send specifically crafted frames that cause the flow-controller to throw an exception, triggering a resource leak. This leak can lead to an OutOfMemoryError (OOME), potentially crashing the Java Virtual Machine (JVM).

Recommendations Update to version 4.1.135.Final. Update to version 4.2.15.Final.