CVE-2026-48748

Name of the Vulnerable Software and Affected Versions Netty versions 4.2.0.Final through 4.2.14.Final

Description A memory exhaustion issue exists in the Netty HTTP/3 codec within the io.netty.handler.codec.http3.QpackDecoder component. The flaw occurs in the shouldWaitForDynamicTableUpdates() function when QPACK dynamic tables are enabled but HTTP3 SETTINGS QPACK BLOCKED STREAMS is not explicitly configured, causing it to default to 0. Due to an incorrect conditional check, the limit on blocked streams is bypassed, allowing a remote attacker to create an infinite number of blocked streams. Because the QpackDecoder fails to remove unblocked streams from the blockedStreams map or decrement the counter, the ReadResumptionListener for each stream remains in memory for the connection's lifetime. This leads to an Out of Memory (OOM) error, crashing the Java Virtual Machine (JVM) and resulting in a Denial of Service.

Recommendations Update to version 4.2.15.Final.