CVE-2026-48043 netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

🗓️ 12 Jun 2026 14:39:52Reported by GitHub_MType

CVE-2026-48043 in Netty HTTP/2 may leak ByteBuf memory, risking JVM out of memory.

Reporter	Title	Published	Views	Family All 161
IBM Security Bulletins	Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities	12 Aug 202614:41	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance	10 Aug 202610:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilies in Netty impacting IBM webMethods API Management	2 Sep 202613:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in third-party Netty libraries affect the IBM Informix Wire Listener.	17 Aug 202608:03	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-47244, CVE-2026-48043)	3 Aug 202608:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	20 Aug 202615:38	–	ibm
Atlassian	DoS (Denial of Service) netty-codec-http2 Dependency in Bitbucket Data Center	15 Jul 202604:29	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Crowd Data Center	1 Aug 202604:32	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Jira Service Management Data Center	4 Aug 202617:31	–	atlassian

[
  {
    "vendor": "netty",
    "product": "netty",
    "versions": [
      {
        "version": ">= 4.2.0.Final, < 4.2.15.Final",
        "status": "affected"
      },
      {
        "version": "< 4.1.135.Final",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/netty/netty/releases/tag/netty-4.1.135.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.15.Final
github	www.github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j

12 Jun 2026 14:39Current

CVSS 3.15.3

EPSS0.00617